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CROSS REFERENCE TO RELATED APPLICATIONS 

[0001] This application is a continuation-in-part of U.S. Ser. No. 
09/384,393, filed August 27, 1999, pending, which is a continuation-in-part of 
U.S. Ser. No. 09/364,690, filed July 30, 1999, abandoned. 

BACKGROUND OF THE INVENTION 

Field of the Invention 

[0^02] The present invention relates to military vehicles. In 
particular, this invention relates to a military vehicle having a coopef-ative control 
network with distributed I/O interfacing. In a particularly preferred aspect, this 
invention relates to a/rjiilitary vehicle having a control system that is capable of 
reconfiguring itseljf IrKtSS-P^se to a failure mode of operation. The present 
invention also relajes to a method of controlling electrical devices on a military 
vehicle. 

2. Description of Related Art 

[0003] A diverse array of military vehicles exist that are used in 
combat and non-combat scenarios. Such vehicles include vehicles that are found 
only in military settings, such as tanks, as well as vehicles that are military 
adaptations of widely used civilian vehicles, such as dump trucks, water pump 
trucks, wrecker trucks (for towing other vehicles), telephone trucks (for digging 
holes for telephone poles), and so on. Depending on the type of military vehicle 
and its intended military application, it is often desirable for the military vehicle 
to be able to withstand a severe amount of punishment and yet still remain 
operational, for example, when the vehicle has been damaged by enemy fire, 
nearby explosions, and so on. 



001.971601.1 



-1- 



Atty. Dkt. No.: 61300/225 



[0004] Currently, control systems that are used for military 
vehicles vary widely depending among other things on the task that the vehicle 
is designed to perform. At one end of the spectrum are military vehicles that 
have almost entirely mechanical control systems with very little if any on-board 
computing capacity. At the other end of the spectrum are military vehicles that 
include highly complex, autonomously operating vehicle subsystems that 
communicate over a standard automotive communication bus such as SAE 
J1708 or J1939. While the latter approach is advantageous to the extent that 
additional functionality is provided, jt can be disadvantageous to the extent that 
increased complexity creates additional opportunity for failure in the event that 
the vehicle is damaged in combat. 'Additionally, even in these systems, an 
extensive amount of hardwiring is used to interconnect discrete I/O devices, 
thereby limiting the robustness and flexibility of the control system that is 
provided. 

[0005] There is an ongoing need for improved military vehicle 
control systems that are intelligent and robust. There is also an ongoing need for 
improved military vehicle control systems that are intelligent and robust and that 
can continue to operate at a maximum level of effectiveness when the vehicle is 
damaged by enemy fire, nearby explosions, and so on. The present invention 
provides a military vehicle control system that meets these needs. 

BRIEF SUMMARY OF THE INVENTION 

[0006] According to a first aspect of the invention, a power 
distribution and control system for a military vehicle comprises a power source, 
a power transmission link, a plurality of input and output devices, a plurality of 
microprocessor-based interface modules, and a communication network that 
interconnects the interface modules. The interface modules are also each 
coupled to respective local subsets of the input and output devices so as to 
permit distributed data collection from the input devices and distributed power 
distribution to the output devices. Each of the interface modules collects input 
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status information from the respective local subset of the input devices and 
broadcasts the input status information over the communication network to 
each of the remaining ones of the interface modules. Each of the remaining 
ones of the interface modules receive the input status information and locally 
store the input status information. 

[0007] Other objects, features, and advantages of the present 
invention will become apparent to those skilled in the art from the following 
detailed description and accompanying drawings. It should be understood, 
Ci however, that the detailed description and specific examples, while indicating 
fij preferred embodiments of the present invention, are given by way of illustration 
and not limitation. Many modifications and changes within the scope of the 
present invention may be made without departing from the spirit thereof, and 
the invention includes all such modifications. 

BRIEF DESCRIPTION OF THE DRAWINGS 

[0008] Fig. 1 is a schematic view of a fire truck having a control 
system according to one embodiment of the present invention; 

[0009] Fig. 2 is a block diagram of the control system of Fig. 1 
showing selected aspects of the control system in greater detail; 

[0010] Fig. 3. is a simplified block diagram of the control system 

of Figs. 1 -2; 

[0011] Fig. 4 is a flowchart showing the operation of the control 
system of Fig. 3 to turn on an output device in response to an operator input; 

[0012] Fig. 5 is a flowchart showing the operation of the control 
system of Fig. 3 to turn off an output device in response to the failure of an 
interlock condition; 

[0013] Fig. 6 is another simplified block diagram of the control 
system of Figs. 1-2; 
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[0014] Fig. 7 is a flowchart showing the operation of the control 
system of Fig. 6 to implement load management when battery voltage 
decreases; 

[0015] Fig. 8 is a flowchart showing the operation of the control 
system of Fig. 6 to restore power to output devices that have been shed during 
the load management illustrated in Fig. 7; 

[0016] Fig. 9 is another simplified block diagram of the control 
system of Figs. 1-2; 

[0017] Figs. 10A-10B are flowcharts showing the operation of 
the control system of Fig. 9 to implement load sequencing in response to an 
operator input; 

[0018] Figs. 1 1 A-1 IB are flowcharts showing the operation of 
the control system of Fig. 9 to implement load sequencing in different orders 
depending on an operating mode of the fire truck; 

[0019] Fig. 1 2 is a schematic view of an aerial device having a 
control system according to another embodiment of the present invention; 

[0020] Fig. 1 3 is a more detailed block diagram of the control 
system of Fig. 1 2; 

[0021] Fig. 14 is a schematic view of a military vehicle having a 
control system according to another embodiment of the present invention; 

[0022] Figs. 1 5-1 6 are block diagrams of the control system of 
Fig. 14 showing selected aspects of the control system in greater detail, and 
Figs. 17A-17B are modified views of the block diagram of Fig. 16 showing the 
operation of the control system to reconfigure itself in a failure mode of 
operation; 

[0023] Fig. 1 8 is a diagram showing the memory contents of an 
exemplary interface module in greater detail; and 
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[0024] Fig. 19 is truth table in which an output is controlled with 
an additional layer of failure management for inputs with undetermined states. 

[0025] Fig. 20 is a block diagram of the control systern of Fig. 
14 showing selected aspects of the control system in greater detail; 

[0026] Fig. 21 is an I/O status table of Fig. 20 shown in greater 

detail; 

A\ 

[0027] " Ptg. 22 i s -a f l owchart dooor i bing th e oper a t i on - of Jba 
A 

- eontro l syo^om of Fig. 20 in groater dpta ii; 

AZ 

[0028] ^i ^'?^ Ha tn f\n\r \f rtk>r|rnm Hnonr i h i ng Hntn f\n\f\ f 

t«b<:^ugj=h-errex e iii p l d i y iii Le i rdCe modu l e du ii ny L l iu p ru ccuu of Fig. 22rand ' 

[0029] -Ei g^ ^3AJg ^ f |^\/^ /rhnrt Hnonrihinr| thn rwpntyH ii ii i iif \ \ \ *4 
^ nnntrni ny aloi u iif fiij 90 inrhnn ■:^n intftrfarp mnHiilf:* hac; hp^Pn rpnHp>rRH 

u 

^ -mepeiiabie^ 

C DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS 

H 

A. Fire Truck Control System 

[0030] For convenience, the contents of U.S. Ser. No. 
09/364,690, upon which priority is claimed, are repeated below. The remainder 
of U.S. Ser. No. 09/364,690 that is not repeated below is hereby incorporated 
by reference. 

1 . Architecture of Preferred Fire Truck Control System 

[0031] Referring now to Fig. 1, a preferred embodiment of a fire 
truck 10 having a control system 1 2 is illustrated. By way of overview, the 
control system 12 comprises a central control unit 14, a plurality of 
microprocessor-based interface modules 20 and 30, a plurality of input devices 
40 and a plurality of output devices 50. The central control unit 14 and the 
interface modules 20 and 30 are connected to each other by a communication 
network 60. 
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[0032] More specifically, the central control unit 14 is a 
microprocessor-based device and includes a microprocessor 1 5 that executes a 
control program 16 (see Fig. 2) stored in memory of the central control unit 14. 
The control program is shown and described in greater detail below in 
conjunction with the flowcharts of Figs. 4, 5, 7, 8 and 10. In general, the 
control unit 14 executes the program to collect and store input status 
information from the input devices 40, and to control the output devices 50 
based on the collected status information. The control program preferably 
implements an interlock system (e.g.. Fig. 5), a load manager (e.g.. Figs. 7-8), 
and a load sequencer (e.g.. Figs. 10A-10B). As described below, the central 
control unit 14 is preferably not connected to the I/O devices 40 and 50 directly 
but rather only indirectly by way of the interface modules 20 and 30, thereby 
enabling distributed data collection and power distribution. The I/O devices 40 
and 50 are located on a chassis 1 1 of the fire truck 10, which includes both the 
body and the underbody of the fire truck 1 0. 

[0033] In the illustrated embodiment, two different types of 
interface modules are used. The interface modules 20 interface mainly with 
switches and low power indicators, such as LEDs that are integrally fabricated 
with a particular switch and that are used to provide visual feedback to an 
operator regarding the state of the particular switch. For this reason, the 
interface modules 20 are sometimes referred to herein as "SIMs" ("switch 
interface modules"). Herein, the reference numeral "20" is used to refer to the 
interface modules 20 collectively, whereas the reference numerals 21 , 22 and 
23 are used to refer to specific ones of the interface modules 20. 

[0034] The interface modules 30 interface with the remaining I/O 
devices 40 and 50 on the vehicle that do not interface to the interface modules 
20, and therefore are sometimes referred to herein as "VIMs" ("vehicle interface 
modules"). The interface modules 30 are distinguishable from the interface 
modules 20 mainly in that the interface modules 30 are capable of handling both 
analog and digital inputs and outputs, and in that they are capable of providing 
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more output power to drive devices sucli as gauges, valves, solenoids, vehicle 
lighting and so on. The analog outputs nnay be true analog outputs or they nnay 
be pulse width modulation outputs that are used to emulate analog outputs. 
Herein, the reference numeral "30" is used to refer to the interface modules 30 
collectively, whereas the reference numerals 31, 32, 33, 34 and 35 are used to 
refer to specific ones of the interface modules 30. 

[0035] Although two different types of interface modules are 
^ used in the illustrated embodiment, depending on the application, it may be 

desirable to use only a single type of interface module in order to reduce 
f\i inventory requirements. Additionally, while in Fig. 1 three of the interface 
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modules 20 and five of the interface modules 30 are shown, this arrangement is 
again simply one example. It may be desirable to provide each interface module 
with more I/O points in order to reduce the number of interface modules that are 
required, or to use more interface modules with a smaller number of I/O points 
in order to make the control system 12 more highly distributed. Of course, the 
number of interface modules will also be affected by the total number of I/O 
points in the control system. 

[0036] Figure 1 shows an approximate distribution of the 
interface modules 20 and 30 throughout the fire truck 10. In general, in order to 
minimize wiring, the interface modules 20 and 30 are placed so as to be located 
as closely as possible to the input devices 40 from which input status 
information is received and the output devices 50 that are controlled. As shown 
in Fig. 1 , there is a large concentration of interface modules 20 and 30 near the 
front of the fire truck 10, with an additional interface module 34 at mid-length 
of the fire truck 10 and another interface module 35 at the rear of the fire truck 
10. The large concentration of interface modules 20 and 30 at the front of the 
fire truck 10 is caused by the large number of switches (including those with 
integral LED feedback output devices) located in a cab of the fire truck 10, as 
well as the large number of other output devices (gauges, lighting) which tend 
to be located in the cab or otherwise near the front of the fire truck 10. The 
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interface module 34 that is located in the nniddle of the truck is used in 
connection with I/O devices 40 and 50 that are located at the fire truck pump 
panel (i.e., the operator panel that has I/O devices for operator control of the fire 
truck's pump system). The interface module 35 that is located at the rear of the 
fire truck 1 0 is used in connection with lighting and other equipment at the rear 
of the fire truck 10. 

[0037] The advantage of distributing the interface modules 20 
and 30 in this manner can be more fully appreciated with reference to Fig. 2, 
which shows the interconnection of the interface modules 20 and 30. As shown 
in Fig. 2, the interface modules 20 and 30 receive power from a power source 
100 by way of a power transmission link 103. The power transmission link 103 
may comprise for example a single power line that is routed throughout the fire 
truck 10 to each of the interface modules 20 and 30. The interface modules 
then distribute the power to the output devices 50, which are more specifically 
designated with the reference numbers 51a, 52a, 53a, 54a-c, 55a-c, 56a-b, 
57a-c and 58a-d in Fig. 2. 

[0038] It is therefore seen from Figs. 1 and 2 that the relative 
distribution of the interface modules 20 and 30 throughout the fire truck 1 0 in 
combination with the arrangement of the power transmission link 103 allows 
the amount of wiring on the fire truck 10 to be dramatically reduced. The power 
source 100 delivers power to the interface modules 20 and 30, which act 
among other things as power distribution centers, and not directly to the output 
devices 50. Because the interface modules 20 and 30 are located so closely to 
the I/O devices 40 and 50, most of the I/O devices can be connected to the 
interface modules 20 and 30 using only a few feet of wire or less. This 
eliminates the need for a wire harness that extends the length of the fire truck 
(about forty feet) to establish connections for each I/O devices 40 and 50 
individually. 

[0039] Continuing to refer to Fig. 2, the switch interface modules 
20 and the interconnection of the interface modules 20 with various I/O devices 
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will now be described in greater detail. The interface modules 20 are 
microprocessor-based, as previously noted, and include a microprocessor that 
executes a program to enable communication over the communication network 
60, as detailed below. 

[0040] The same or a different microprocessor of the interface 
modules 20 may also be used to process input signals received from the input 
devices 40. In particular, the interface modules 20 preferably perform debounce 
filtering of the switch inputs, so as to require that the position of the switch 
become mechanically stable before a switch transition is reported to the central 
control unit 14, For example, a delay of fifty milliseconds may be required 
before a switch transition is reported. Performing this filtering at the interface 
modules 20 reduces the amount of processing that is required by the central 
control unit 14 to interpret switch inputs, and also reduces the amount of 
communication that is required over the communication network 60 because 
each switch transition need not be reported. 

[0041] Physically, the interface modules 20 may be placed near 
the headliner of a cab 1 7 of the fire truck 10. Traditionally, it is common 
practice to locate panels of switches along the headliner of the cab for easy 
access by an operator of the fire truck. Additionally, as detailed below, in the 
preferred embodiment, the interface modules 20 are connected to switches that 
have integrally fabricated LEDs for indicating the state of the output device 
controlled by the switch to provide maximum operator feedback. These LEDs are 
output devices which are connected to the interface modules 20, Therefore, by 
locating the interface modules near the headliner of the cab, the amount of 
wiring required to connect the interface modules 20 not only to the switches 
and but also to the LED indicators is reduced. 

[0042] In the preferred embodiment, the interface modules 20 
have between ten and twenty-five each of inputs and outputs and, more 
preferably, have sixteen digital (on/off switch) inputs and sixteen LED outputs. 
Most of these inputs and outputs are utilized in connection with switches having 
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integrally fabricated LEDs. However, it should be noted that there need not be a 
one-to-one correspondence between the switches and the LEDs, and that the 
inputs and the outputs of the interface modules 20 need not be in matched 
pairs. For example, some inputs may be digital sensors (without a corresponding 
output device) and some of the outputs may be ordinary digital indicators 
(without a corresponding input device). Additionally, the LED indicators 
associated with the switch inputs for the interface module 21 could just as 
easily be driven by the interface module 23 as by the interface module 21, 
although this arrangement is not preferred. Of course, it is not necessary that all 
of the inputs and outputs on a given interface module 20 be utilized and, in fact, 
it is likely that some will remain unutilized. 

[0043] One way of establishing a dedicated link between the I/O 
devices 40 and 50 and the interface modules 20 is through the use of a simple 
hardwired link. Considering for example an input device which is a switch, one 
terminal of the switch may be connected (e.g., by way of a harness connector) 
to an input terminal of the interface module 20 and the other terminal of the 
switch may be tied high (bus voltage) or low (ground). Likewise, for an output 
device which is an LED, one terminal of the LED may be connected to an output 
terminal of the interface module 20 and the other terminal of the LED may again 
be tied high or low. Other dedicated links, such as RF links, could also be used. 

[0044] To provide maximum operator feedback, the LEDs that 
are located with the switches have three states, namely, off, on, and blinking. 
The off state indicates that the switch is off and therefore that the device 
controlled by the switch is off. Conversely, the on state indicates that the 
switch is on and that the device controlled by the switch is on. The blinking 
state indicates that the control system 1 2 recognizes that a switch is on, but 
that the device which the switch controls is nevertheless off for some other 
reason (e.g., due to the failure of an interlock condition, or due to the operation 
of the load manager or load sequencer). Notably, the blinking LED feedback is 
made possible by the fact that the LEDs are controlled by the control unit 14 
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and not directly by the switches themselves, since the switches themselves do 
not necessarily know the output state of the devices they control. 

[0045] A specific example will now be given of a preferred 
interconnection of the interface modules 21 , 22, and 23 with a plurality of I/O 
devices 40 and 50. Many or all of the I/O devices 40 and 50 could be the same as 
those that have previously been used on fire trucks. Additionally, it should be 
noted that the example given below is just one example, and that a virtually 
unlimited number of configurations are possible. This is especially true since fire 
trucks tend to be sold one or two at a time and therefore each fire truck that is 
sold tends to be unique at least in some respects. 

[0046] In Fig. 2, the interface module 21 receives inputs from 
switches 41a that control the emergency lighting system of the fire truck. As 
previously noted, the emergency lighting system includes the flashing emergency 
lights {usually red and white) that are commonly associated with fire trucks and 
that are used to alert other motorists to the presence of the fire truck on the 
roadway or at the scene of a fire. One of the switches 41 a may be an emergency 
master on/off (E-master) switch used to initiate load sequencing, as described in 
greater detail below. The interface module 21 may also be connected, for 
example, to switches 41b that control the emergency siren and horn. The 
interface module 21 is also connected to LEDs 51a that are integrally located in 
the switches 41a and 41b and that provide operator feedback regarding the 
positions of the switches 41a and 41b, as previously described. 

[0047] The interface module 22 receives inputs from switches 42a 
that control lighting around the perimeter of the fire truck 10, switches 42b that 
control scene lighting, and switches 42c that control lighting which aids the 
operators in viewing gauges and other settings at the pump panel. The interface 
module 22 is also connected to LEDs 52a that are integrally located in the 
switches 42a, 42b and 42c and that provide operator feedback regarding the 
positions of the switches 42a, 42b and 42c. 
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[0048] The interface module 23 receives inputs from switches 43a 
that control heating and air conditioning, and switches 43b that controls 
miscellaneous other electrical devices. The interface module 23 is connected to 
LED indicators, some of which may be integrally located with the switches 43a 
and 43b and others of which may simply be an LED indicator that is mounted on 
the dashboard or elsewhere in the cab of the fire truck 10. 

[0049] Continuing to. refer to Fig. 2, the vehicle interface 
modules 30 and the interconnection of the interface modules 20 with various 
I/O devices will now be described in greater detail. As previously mentioned, the 
interface modules 30 are distinguishable from the interface modules 20 mainly 
in that the interface modules 30 are capable of handling both analog and digital 
inputs and outputs, and in that they are capable of providing more output power 
to drive output devices such as digitally-driven gauges, solenoids, and so on. 
The interface modules 30 preferably have between fifteen and twenty-five each 
inputs and outputs and, more preferably, have twenty inputs (including six 
digital inputs, two frequency counter inputs, and six analog inputs) and twenty 
outputs (including six outputs that are configurable as analog outputs). 

[0050] Like the interface modules 20, the interface modules 30 
are microprocessor-based and include a microprocessor that executes a program 
to enable communication over the communication network 60. The same or a 
different microprocessor of the interface modules 30 may also be used to 
process input signals received from the input devices 40 and to process output 
signals transmitted to the output devices 50. 

[0051] For the interface modules 30, this processing includes not 
only debounce filtering, in the case of switch inputs, but also a variety of other 
types of processing. For example, for analog inputs, this processing includes any 
processing that is required to interpret the inputs from analog-to-digital (A/D) 
converters, including converting units. For frequency inputs, this processing 
includes any processing that is required to interpret inputs from frequency-to- 
digital converters, including converting units. This processing also includes other 
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simple filtering operations. For example, in connection with one analog input, 
this processing may include notifying the central control unit 14 of the status of 
an input device only every second or so. In connection with another analog 
input, this processing may include advising the central control unit 14 only when 
the status of the input device changes by a predetermined amount. For analog 
output devices, this processing includes any processing that is required to 
interpret the outputs for digital-to-analog (D/A) converters, including converting 
units. For digital output devices that blink or flash, this processing includes 
implementing the blinking or flashing (i.e., turning the output device on and off 
at a predetermined frequency) based on an instruction from the central control 
unit 14 that the output device should blink or flash. In general, the processing 
by the interface modules 30 reduces the amount of information which must be 
communicated over the communication link, and also reduces the amount of 
time that the central control unit 14 must spend processing minor changes in 
analog input status. 

[0052] Preferably, the configuration information required to 
implement the I/O processing that has just been described is downloaded from 
the central control unit 14 to each interface module 30 (and each interface 
module 20) at power-up. Additionally, the harness connector that connects to 
each of the interface modules 20 and 30 are preferably electronically keyed, 
such that being connected to a particular harness connector provides the 
interface modules 20 and 30 with a unique identification code (for example, by 
tying various connector pins high and low to implement a binary code). The 
advantage of this approach is that the interface modules 20 and 30 become 
interchangeable devices that are customized only at power-up. As a result, if 
one of the interface modules 30 malfunctions, for example, a new interface 
module 30 can be plugged into the control system 12, customized automatically 
at power-up (without user involvement), and the control system 12 then 
becomes fully operational. This enhances the maintainability of the control 
system 1 2. 
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[0053] A specific example will now be given of a preferred 
interconnection of the interface modules 31, 32, and 33 with a plurality of I/O 
devices 40 and 50. This example continues the example that was started in 
connection with the interface modules 21, 22, and 23. Again, it should be noted 
that the configuration described herein is just one example. 

[0054] The interface modules 31, 32, 33, 34 and 35 all receive 
inputs from additional switches and sensors 44a, 45a, 46a, 47a and 48a. The 
switches may be additional switches that are located in the cab of the fire truck 
or elsewhere throughout the vehicle, depending on the location of the interface 
module. The sensors may be selected ones of a variety of sensors that are 
located throughout the fire truck. The sensors may be used to sense the 
mechanical status of devices on the fire truck, for example, whether particular 
devices are engaged or disengaged, whether particular devices are deployed, 
whether particular doors on the fire truck are open or closed, and so on. The 
sensors may also be used to sense fluid levels such as fuel level, transmission 
fluid level, coolant level, foam pressure, oil level, and so on. 

[0055] In addition to the switches and sensors 44a, the interface 
module 31 is also connected to a portion 54a of the emergency lighting system. 
The emergency lighting system includes emergency lights (usually red and 
white) at the front, side and rear of the fire truck 10. The emergency lights may, 
for example, be in accordance with the guidelines provided by the National Fire 
Protection Association. Because the interface module 31 is located at the front 
of the fire truck, the interface module 31 is connected to the red and white 
emergency lights at the front of the fire truck. 

[0056] The interface module 31 is also connected to gauges and 
indicators 54b which are located on the dashboard of the fire truck 10. The 
gauges may indicate fluid levels such as fuel level, transmission fluid level, 
coolant level, foam pressure, oil level and so on. The indicators may include, for 
example, indicators that are used to display danger, warning and caution 
messages, warning lights, and indicators that indicate the status of various 
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mechanical and electrical systenns on the fire truck. The interface module 31 
may also be connected, for example, to an emergency sound system including 
an emergency siren and emergency air horns 54c, which are used in 
combination with the emergency lights 54a. 

[0057] In addition to the switches and sensors 45a, the interface 
module 32 is also connected to perimeter lighting 55a, scene lighting 55b and 
utility lighting 55c, The perimeter lighting 55a illuminates the perimeter of the 
_ fire truck 10. The scene lighting 55b includes bright flood lights and/or spot 
€\ lights to illuminate the work area at a fire. The utility lighting 55c includes 

lighting used to light operator panels, compartments and so on of the fire truck 



w 
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10. 

[0058] In addition to the switches and sensors 46a, the interface 
module 33 is also connected to PTO sensors 46b. The PTO sensors 46b monitor 
the status of a power take-off mechanism 97 (see Fig. 1), which diverts 
mechanical power from the engine/transmission from the wheels to other 
mechanical subsystems, such as the pump system, an aerial system and so on. 
The interface module 33 is also connected to a portion 56a of the FMVSS 
(Federal Motor Vehicle Safety Standard) lighting. The FMVSS lighting system 
includes the usual types of lighting systems that are commonly found on most 
types of vehicles, for example, head lights, tail lights, brake lights, directional 
lights (including left and right directionals), hazard lights, and so on. The 
interface module 33 is also connected to the heating and air conditioning 56b. 

[0059] In addition to the switches and sensors 47a, the interface 
module 34, which is disposed near the pump panel, is connected to pump panel 
switches and sensors 47a, pump panel gauges and indicators 57a, pump panel 
lighting 57b, and perimeter lighting 57c. The pump system may be manually 
controlled or may be automatically controlled through the use of electronically 
controlled valves. In either case, the various fluid pressures are measured by 
sensors and displayed on the gauges and indicators 57a. 
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[0060] Finally, in addition to the switches and sensors 48a, the 
interface module 35 is also connected to emergency lighting 58a, scene lighting 
58b, FMVSS lighting 58c, and the utility lighting 58d. These lighting systems 
have been described above. 

[0061] The interface modules 20 and the interface modules 30 
are connected to the central control unit 14 by the communication network 60. 
The communication network may be implemented using a network protocol, for 
example, which is in compliance with the Society of Automotive Engineers 
(SAE) J1 708/1 587 and/or J1939 standards. The particular network protocol 
that is utilized is not critical, although all of the devices on the network should 
be able to communicate effectively and reliably. 

[0062] The transmission medium may be implemented using 
copper or fiber optic cable. Fiber optic cable is particularly advantageous in 
connection with fire trucks because fiber optic cable is substantially immune to 
electromagnetic interference, for example, from communication antennae on 
mobile news vehicles, which are common at the scenes of fires. Additionally, fiber 
optic cable is advantageous because it reduces RF emissions and the possibility of 
short circuits as compared to copper-based networks. Finally, fiber optic cable is 
advantageous because it reduces the possibility of electrocution as compared to 
copper in the event that the cable accidentally comes into contact with power 
lines at the scene of a fire. 

[0063] Also connected to the communication network 60 are a 
plurality of displays 81 and 82. The displays 81 and 82 permit any of the data 
collected by the central control unit 14 to be displayed to the firefighters in real 
time. In practice, the data displayed by the displays 81 and 82 may be displayed 
in the form of text messages and may be organized into screens of data (given 
that there is too much data to display at one time) and the displays 81 and 82 
may include membrane pushbuttons that allow the firefighters to scroll through, 
page through, or otherwise view the screens of data that are available. 
Additionally, although the displays 81 and 82 are both capable of displaying any 
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of the information collected by the central control unit 14, in practice, the 
displays 81 and 82 are likely to be used only to display selected categories of 
information. For example, assuming the display 81 is located in the cab and the 
display 82 is located at the pump panel, the display 81 is likely to be used to 
display information that pertains to devices which are controlled from within the 
cab, whereas the display 82 is likely to be used to display information pertaining 
to the operation of the pump panel. Advantageously, the displays 81 and 82 
give firefighters instant access to fire truck information at a single location, 
which facilitates both normal operations of the fire truck as well as 
troubleshooting if problems arise. 

[0064] Also shown in Fig. 2 is a personal computer 85 which is 
connected to the control unit 14 by way of a communication link 86, which may 
be a modem link, an RS-232 link, an internet link, and so on. The personal 
computer 85 allows diagnostic software to be utilized for remote or local 
troubleshooting of the control system 12, for example, through direct 
examination of inputs, direct control of outputs, and viewing and controlling 
internal states, including interlock states. Because all I/O status information is 
stored in the central control unit 14, this information can be easily accessed and 
manipulated by the personal computer 85. If a problem is encountered, the 
personal computer can be used to determine whether the central control unit 1 4 
considers all of the interface modules 20 and 30 to be "on-line" and, if not, the 
operator can check for bad connections and so on. If a particular output device 
is not working properly, the personal computer 85 can be used to trace the I/O 
status information from the switch or other input device through to the 
malfunctioning output device. For example, the personal computer 85 can be 
used to determine whether the switch state is being read properly, whether all 
interlock conditions are met, and so on. 

[0065] The personal computer 85 also allows new firmware to 
be downloaded to the control unit 14 remotely (e.g., from a different city or 
state by way of the internet or a telephone link) by way of the communication 
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link 86. The firmware can be firmware for the control unit 14, or it can be 
firmware for the interface modules 20 and 30 that is downloaded to the control 
unit 14 and then transmitted to the interface modules 20 and 30 by way of the 
communication network 60. 

[0066] Finally, referring back to Fig. 1, several additional systems 
are shown which will now be briefly described before proceeding to a discussion 
of the operation of the control system 12. In particular. Fig. 1 shows an engine 
system including an engine 91 and an engine control system 92, a transmission 
system including a transmission 93 and a transmission control system 94, and 
an anti-lock brake system including an anti-lock brake control system 95 and 
anti-lock brakes 96. The transmission 93 is mechanically coupled to the engine 
91, and is itself further mechanically coupled to a PTO system 97. The PTO 
system 97 allows mechanical power from the engine to be diverted to water 
pumps, aerial drive mechanisms, stabilizer drive mechanisms, and so on. In 
combination, the engine system, the transmission system and the PTO system 
form the power train of the fire truck 10. 

[0067] The control systems 92, 94 and 95 may be connected to 
the central control unit 14 using the same or a different communication network 
than is used by the interface modules 30 and 40. In practice, the control 
systems 92, 94 and 95 are likely to be purchased as off-the-shelf systems, 
since most fire truck manufacturers purchase rather than manufacture engine 
systems, transmission systems and anti-lock brake systems. As a result, it is 
likely that the control systems 92, 94 and 95 will use a variety of different 
communication protocols and therefore that at least one additional 
communication network will be required. 

[0068] By connecting the systems 92, 94 and 95 to the central 
control unit 14, an array of additional input status information becomes available 
to the control system 1 2. For example, for the engine, this allows the central 
control unit 14 to obtain I/O status information pertaining to engine speed, 
engine hours, oil temperature, oil pressure, oil level, coolant level, fuel level, and 
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so on. For the transmission, this allows the central control unit 14 to obtain, for 
example, information pertaining transmission temperature, transmission fluid 
level and/or transmission state (1st gear, 2nd gear, and so on). Assuming that 
an off-the-shelf engine or transmission system is used, the information that is 
available depends on the manufacturer of the system and the information that 
they have chosen to make available. 

[0069] Connecting the systems 92, 94 and 95 to the central 
control unit 14 is advantageous because it allows information from these 
subsystems to be displayed to firefighters using the displays 81 and 82. This 
also allows the central control unit 14 to implement various interlock conditions 
as a function of the state of the transmission, engine or brake systems. For 
example, in order to turn on the pump system (which is mechanically driven by 
the engine and the transmission), an interlock condition may be implemented 
that requires that the transmission be in neutral or 4th lockup (i.e., fourth gear 
with the torque converter locked up), so that the pump can only be engaged 
when the wheels are disengaged from the power train. The status information 
from these systems can therefore be treated in the same manner as I/O status 
information from any other discrete I/O device on the fire truck 10. It may also 
be desirable to provide the central control unit 14 with a limited degree of 
control over the engine and transmission systems, for example, enabling the 
central control unit 14 to issue throttle command requests to the engine control 
system 91 . This allows the central control unit to control the speed of the 
engine and therefore the voltage developed across the alternator that forms part 
of the power source 100. 

2. Manner of Operation of Preferred Fire Truck Control System 

[0070] The operation of the control system 12 will now be 
described in greater detail, including the manner in which interlock control, load 
management, and load sequencing are implemented by the control system 12. 
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a. Operation Overview and Interlock Control 

[00711 Referring now to Figs, 3-5, a first example of the 
operation of the control system 1 2 is given. Figure 3 is a block diagram of the 
control system 1 2, which has been simplified to the extent that some of the 
structure shown in Figs. 1-2 is not shown in Fig. 3. Additionally, Fig. 3 shows in 
greater detail a switch 341 (which is one of the switches 41a in Fig. 2), rear 
scene lights 351 (which are part of the rear scene lighting 58b in Fig. 2), and an 
LED indicator 352 (which is one of the switch LED feedback indicators 51a in 
Fig. 2). The rear scene lights 351 are considered a single output device since 
they are both connected to one output of the interface module 35, even though 
there are in fact two lights. Finally, the central control unit 14 is also shown to 
include an interlock system 316, which is implemented in the control program 
16 executed by the microprocessor 15. 

[0072] Figure 4 is a flowchart showing the operation of the 
control system 1 2 to activate the rear scene lights 351 in response to an input 
signal received from the switch 341 . One of the advantages of the control 
system 1 2 is that input signals from the input devices 40 are processed by the 
control unit 14 and do not directly control the output devices 50. Switches 
represent user input commands but do not close the electrical circuit between 
the power source 100 and the output device controlled by the switch. As will be 
described below, this simplifies control system wiring and makes possible more 
flexible control of output devices. 

[0073] In order to highlight this aspect of the control system 1 2, 
it will be assumed that the switch 341 is a soft toggle switch. Thus, the switch 
341 is physically a momentary switch, i.e., a switch that closes when pressed 
but, when pressure is removed, automatically returns to an open position. The 
control system 12 makes the switch 341 emulate a latched switch, i.e., a 
switch that remains closed when pressed and returns to an open position only 
when pressed again. 
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[0074] First, in step 401 , the switch 341 transmits an input 
signal to the interface module 21 . The input signal is transmitted to the interface 
module 21 as a result of a change in the status of the switch, for example, 
when an operator presses the switch. The input signal from the switch 341 is 
transmitted to the interface module 21 by way of a hardwired communication 
link 101 which may, for example, comprise a wire that connects a terminal of 
the switch 341 to an input terminal of the interface module 21 (with the other 
terminal of the switch 341 being tied high or low). Other types of dedicated 
links may also be used. 

[0075] At step 402, the interface module 21 processes the input 
signal. For the switch 341, the interface module performs debounce filtering, for 
example, by waiting until the mechanical position of the switch stabilizes (e.g., 
fifty milliseconds) before the transmitting the input signal to the control unit 14. 

[00761 At step 403, the interface module 21 transmits the input 
signal in the form of a network message to the control unit 14 ("ECU" in Fig. 4) 
The network message is sent by way of the communication network 60 and, in 
particular, by way of a network communication link 61 that links the interface 
module 21 to the control unit 14. 

[0077] At step 404, the control unit 14 processes the input 
signal. As previously noted, the switch 341 is physically a momentary switch 
(i.e., a switch that closes when pressed but, when pressure is removed, 
automatically returns to an open position) but is made to emulate a latched 
switch (i.e., a switch that remains closed when pressed and returns to an open 
position only when pressed again). Accordingly, to process the input signal, the 
control unit 14 first determines that the switch 341 has experienced an off-^on 
transition (i.e., because the switch 341 was previously off but is now on), and 
then determines that the present state of the rear scene lights 351 are off. 
Accordingly, at step 405, the control unit 14 generates a first control signal to 
turn on the rear scene lights 351 , as well as a second control signal to turn on 
LED indicator 352. 
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[0078] At step 406, the control unit 14 transmits the first control 
signal in the form of a second network message to the interface module 35. The 
network message is sent by way of the communication network 60 and, in 
particular, by way of a network communication link 65 that links the central 
control unit 14 to the interface module 35. In practice, the network 
communication link 65 may utilize some or all of the same physical media 
utilized by the network communication link 61, depending on the network 
architecture that is utilized. In the illustrated embodiment a bus architecture is 
utilized, but it should be understood of course that other types of network 
^1 architectures (such as ring or star architectures) may also be utilized. 

ly 

,J [0079] At step 407, the interface module 35 transmits the first 

control signal to the rear lighting system 351 . The control signal is transmitted 

5 in the form of a power control signal on a hardwired communication link 105. 

O 

Cfi The hardwired communication link 105 may, for example, comprise a wire that 

Ml 

P connects a terminal of the switch 341 to an input terminal of the interface 
W module 21 . The power control signal from the interface module 35 has two 

states, namely, an "on'' state in which power is provided to the lighting system 
351 and an "off" in which power is not provided to the lighting system 351 . 

[0080] At step 408, the control unit 14 transmits the second 
control signal to the interface module 21 by way of the network communication 
link 61 in the form of a third network message. At step 409, the interface module 
21 transmits the second control signal to the LED indicator 352 in the form of a 
power control signal on a hardwired communication link 102. As previously noted, 
the LED indicator 352 is located integrally with the switch 341 (e.g., at the tip of 
the lever of the switch 341 , in a manner such that the LED is clearly associated 
with the switch 341). Therefore, when the second control signal is transmitted to 
the LED indicator 352, thereby turning on the LED indicator 352, the LED indicator 
provides feedback to the operator regarding the status of the rear scene lights 
351 . In the present situation, the on state of the LED indicator 352 indicates that 
the rear scene lights 351 are on. 
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[0081] When the switch 341 is released, another input signal 
(not shown) is sent to the interface unit 21 which indicates that the input state 
of the switch has changed from on to off. The control unit 14 recognizes the 
on->off transition, but ignores the transition pursuant to making the switch 341 
emulate a latched switch, 

[0082] It may be noted therefore that the switch 341 does not 
complete the electrical power circuit for the rear scene lights 351 . When the 
switch 341 is released, the switch 341 opens but this change does not cause 
any change in the output status of the scene lights 351 . The opportunity for the 
central control unit 14 to process the input signal from the switch 341 (as well 
as other input devices) makes the control system 1 2 more flexible and robust 
while at the same time reducing wiring and therefore reducing the number of 
failure points. 

[0083] For example, a feature that is easily implemented in the 
control system 1 2 is two-way or, more generally, N-way switching. To 
implement N-way switching, it is only necessary to define N switches as inputs 
that control a given lighting system, and to program the control unit 14 to 
toggle the state of the lighting system every time the latched state of one of the 
N switches changes. A complicated and wiring-intensive N-way switching circuit 
is not required because the control logic required to implement N-way switching is 
not hardwired but rather is programmed into the control unit 14. Another feature 
that is easily implemented is progressive switching, in which the control unit 14 
responds differently each time a given switch is pressed. 

[0084] In addition to the advantages that are achieved due to the 
processing of the inputs, additional advantages are achieved in connection with 
processing the outputs. Thus, another advantage of the control system 1 2 is 
that the outputs are capable of multiple modes of operation, without any 
additional hardware, depending on the mode of operation of the vehicle. Thus, 
the same output device can have a digital mode of operation, an analog mode of 
operation, and a flashing mode of operation. For example, the same set of lights 
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can be made to operate as high beam headlights at night (digital), as day-time 
running lights during the day (analog), and as flashing white lights in an 
emergency situation. (This is especially true if analog outputs are implemented 
using pulse width modulation to emulate a true analog-type output.) Because 
specialized hardware for each mode of operation is not required, it is much 
easier to provide any given output device with the ability to operate in different 
modes. 

[0085] Another advantage with respect to the processing of 
outputs is that the central control unit 14 has the ability to synchronize or 
desynchronize different output devices. For example, in connection with the 
flashing emergency lights, it is possible to more precisely control the emergency 
lights and to have different lights flashing with exactly the same frequency but 
at a different phase. This prevents multiple sets of lights from undesirably 
turning on at the same time. For fire trucks with circuit breakers, this situation is 
undesirable because it can cause the current draw of the multiple sets of lights 
to trip a circuit breaker, thereby rendering the flashing emergency lights 
inoperative altogether. 

[0086] Referring now to Fig. 5, the operation of the control 
system 1 2 to disengage the rear scene lights 351 in response to a changed 
interlock condition is illustrated. Federal Motor Vehicle Safety Standard (FMVSS) 
regulations prohibit the use of white lights on the back of a vehicle when the 
vehicle is moving forward. This regulation prevents other drivers from confusing 
the vehicle with oncoming traffic. Therefore, if a fire truck at the scene of a fire 
has white rear scene lights turned on and a firefighter decides to move the fire 
truck, the firefighter must first remember to turn off the white rear scene lights. 
Figure 5 illustrates the operation of the control system to implement an interlock 
system 316 that eliminates the need for the firefighter to have to remember to 
turn off the rear scene lights in this situation. 

[0087] To implement this type of control, a sensor 342 that 
monitors the status of the parking brake is utilized. The control rules governing the 
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interlock condition for this example are then as follows. The rear scene lights 351 
should disengage when the parking brake is disengaged. However, the rear scene 
lights are allowed to be on when the parking brake is off. Therefore, the rear scene 
lights are turned off only when there is an on->off transition of the parking brake 
and, otherwise, the rear scene lights are allowed to be on. 

[0088] Accordingly, by way of example, the parking brake is 
turned off at step 501 . At step 502, the parking brake sensor 342 transmits an 
input signal to the interface module 31 . At step 503, the interface module 31 
processes the input signal. For example, the interface module 31 performs 
debounce filtering to require stabilization of the mechanical state of the sensor 
before a state change is recognized. 

[0089] At step 504, the interface module 31 transmits the input 
signal in the form of a network to the control unit 1 4 by way of a network 
communication link 67. At step 505, the control unit 14 processes the input 
signal. For example, the control unit 14 determines that the rear scene lights 351 
are on, and that there has been an on->off transition in the state of the parking 
brake sensor 342. Accordingly, at step 506, the control unit 14 generates a first 
control signal to turn off the rear scene lights 351 and a second control signal to 
cause the LED indicator 352 to blink. 

[0090] At step 507, the control unit 14 transmits the first control 
signal in the form of a network message to the interface module 35. In turn, at 
step 508, the interface module 35 transmits the control signal to the rear scene 
light lights 351 , thereby causing the rear scene lights to turn off. 

[0091] At step 509, the control unit 14 transmits the second 
control signal in the form of a network message to the interface module 21 . In 
turn, at step 510, the interface module 35 transmits the control signal to the LED 
indicator 352, thereby causing the LED indicator 352 to blink. The blinking state of 
the LED indicator 352 indicates to the operator that the control unit 14 considers 
the switch 341 to be on, but that the rear scene lights 351 are nevertheless off 
because some other condition on the fire truck is not met. In this case, the rear 
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scene lights 351 are off due to the on->off transition in the state of the parking 
brake. In this way, operator feedback is maxinnized. 

[0092] The flow chart of Fig. 4, at step 51 0, shows the use of a 
single control signal to cause the LED indicator 352 to blink. In practice, the 
blinking of the LED indicator 352 nnay be achieved in a variety of ways. For 
exannple, if a simple hardwired connection between the interface nnodule 21 and 
the LED indicator 352 is utilized, the interface nnodule 21 may periodically provide 
periodic on and off control signals to the LED indicator 352 by periodically 
applying power to the output terminal that is connected to the LED indicator 352. 
Alternatively, if a blinker module is utilized, the interface module may provide a 
single control signal to the blinker module, which then controls blinking of the LED 
indicator 352. 

[0093] If the operator then pushes and releases the switch 341 a 
second time while the parking brake is off, the process in Fig, 4 is repeated and 
the rear scene lights 351 turn on. In this case, the rear scene lights 351 turn on 
even though the parking brake is off, because the control system 12 only prevents 
the rear scene lights from being on when the parking brake is first released. If the 
operator pushes and releases the switch 341 a third time, the control system 1 2 
turns off the rear scene lights 351 . 

b. Load Management 

[0094] Referring now to Figs. 6-8, a second example of the 
operation of the control system 1 2 is given. Figure 6 is another block diagram of 
the control system 1 2, which has been simplified to the extent that some of the 
structure shown in Figs. 1-2 is not shown in Fig. 6. Additionally, Fig. 6 shows a 
plurality of output devices 651, 652, 653 and 654 that have load management 
priority levels equal to one, two, three and four, respectively. The output 
devices 651, 652, 653 and 654 are exemplary ones of the output devices 50 of 
Figs. 1-2. Finally, the central control unit 14 is shown to include a load manager 
616, which is implemented in the control program 16 executed by the 
microprocessor 15. 
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[00951 Because the output devices 651 , 652, 653 and 654 are 
assigned four different load management priority levels, the load manager 616 is 
referred to as a four level load manager. As will become apparent, implementing 
a load manager with additional priority levels can be achieved simply by defining 
additional priority levels. Indeed, it is even possible for the load manager 616 to 
have the same number of levels as there are output devices, by assigning every 
output device a different priority level and by shedding the output devices one 
by one as the battery voltage drops. 

[0096] Figure 7 is a flowchart showing the operation of the load 
manager 615. In particular, the flowchart of Fig. 7 describes the operation of 
the load manager 616 to turn off output devices in layers when the system 
voltage decreases. It may be noted that a similar approach may be used when 
the system voltage increases, in which case devices that are sensitive to over 
voltage conditions may be turned off in layers as the system voltage increases, 

[0097] At step 701, the load manager initializes tracking 
variables and sets the active priority equal to zero. The active priority is the 
priority level that is currently shed. (In the described embodiment, the parameter 
N is typically equal to the active priority minus one. However, the parameter N 
could also simply be equal to the active priority.) Therefore, assuming that none 
of the output devices 651 , 652, 653, 654 are shed, then the active priority 
level is equal to zero. The active priority increases as shedding occurs. 

[0098] At step 702, the control unit 14 determines whether the 
battery voltage has decreased to the priority N load shed voltage. Initially, the 
tracking variable N is equal to one and so, initially, the control unit 14 is 
determining in step 702 whether the battery voltage has decreased enough for 
the first layer of shedding to occur. If the battery voltage has not decreased, 
then the control unit 1 4 continues to monitor the battery voltage until the 
priority 1 load shed voltage is reached. 

[0099] At step 703, when the battery voltage has decreased to 
the priority 1 load shed voltage, then the control unit 14 starts a load shed 
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timer. The purpose of the load shed timer is to ensure that a temporary 
reduction in the battery voltage (for example, caused by engagement of an 
output device that draws a significant amount of current) is not misinterpreted 
as the battery running out of power, so that the control unit 14 does not 
unnecessarily start shedding output devices. 

[01001 The control unit 14 continues to monitor the battery 
voltage at step 704 until the load shed timer elapses at step 705, During this 
time, the control unit 14 continues to monitor whether the battery voltage is 
equal to or less than the priority 1 load shed voltage. If the battery returns 
above the load shed voltage, then that indicates only a temporary voltage 
reduction has occurred and therefore the process returns to step 702 after the 
active priority is set equal to N-1 at step 706. In this case, since N is equal to 
one, the active priority remains equal to zero, in other words, no output devices 
are shed. 

[0101] If the battery voltage is still equal to or less than the 
priority 1 load shed voltage when the load shed timer elapses at step 705, then 
the process proceeds to step 707. At step 707, the control unit 14 determines 
whether any of the priority 1 output devices are active. If none of the priority 1 
output devices 651 are active, then N is incremented by one, and the process 
proceeds to step 702. At step 702, the control unit 14 determines whether the 
battery voltage has decreased to the priority 2 load shed voltage. Thus, because 
the battery voltage is low, but there were no priority 1 output devices 651 to 
shed at step 707, the control unit determines whether it is appropriate to start 
shedding priority 2 output devices 652. The control unit 14 repeats the process 
and continues to search for a level of devices to shed until either the battery 
voltage is not low enough to justify shedding the next layer of devices (in which 
case the process proceeds to step 706, where the active priority is set equal to 
the highest level at which the battery voltage is low enough to cause shedding, 
if there were output devices to shed, and then the process returns to step 702) 
or until step 707 is answered affirmatively (in which case the process proceeds 
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to step 709, where the active priority is set equal to the priority level at which 
output devices are available for shedding, and then the process proceeds to step 
710). 

[0102] At step 710, these output devices are shed, the variable 
N is incremented, and the process proceeds to step 702 where the control unit 
14 deternnines whether the battery voltage is less than the load shed voltage of 
the next priority level. The process then repeats until the battery voltage is 
greater than the load shed voltage of the next priority level. 

[0103] When the active priority level becomes non-zero, the 
control unit 14 denies all requests for engagement of devices that have a priority 
level which is equal to or less than the active priority level. Thus, all devices that 
have a priority level which is equal to or less than the active priority level remain 
off, at least until the battery voltage increases and it becomes appropriate to 
restore some output devices, as described below in connection with Fig. 8. 

[0104] As previously described, some output devices are 
controlled by switches that are integrally fabricated with an LED indicator. For 
such output devices, the control unit 14 causes the appropriate LED indicator to 
start blinking, thereby advising the operator that the switch is recognized by the 
control unit 14 as being turned on, but that the associated output device is 
nevertheless disengaged because it is being load managed. The process of 
making indicator LEDs blink was described previously in connection with Fig. 4. 

[0105] Referring now to Fig. 8, a process for restoring power to 
output devices is illustrated. The battery is connected to the alternator and, if 
loading is reduced enough, the battery will begin to regain voltage. Therefore, it 
may become appropriate to restore power to at least some output devices. The 
process shown in Fig 8 for restoring power is essentially the opposite of the 
process shown in Fig. 7. The process of Fig. 8 may be performed in time 
alternating fashion with respect to the process of Fig. 7. 
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[0106] In particular, at step 801, it is determined whether the 
battery voltage has increased to the priority N load restore voltage. For example, 
if the active priority is currently set equal to three, then step 801 determines 
whether the battery voltage is greater than or equal to the priority 3 load restore 
voltage. The priority 3 load restore voltage is preferably larger than the priority 3 
load shed voltage in order to implement a hysteresis effect that avoids output 
devices from flickering on and off. 

[0107] At step 802, when the battery voltage has increased to 
the priority 3 load restore voltage, then the control unit 14 starts a load restore 
timer. The purpose of the load restore timer is to ensure that a temporary 
voltage surge is not misinterpreted as the battery regaining power, so that the 
control unit 14 does not inappropriately start restoring output devices. 

[0108] The control unit continues to monitor the battery voltage 
at step 803 until the load restore timer elapses at step 804. During this time, 
the control unit 14 continues to monitor whether the battery voltage is still 
equal to or greater than the priority 3 load shed voltage. If the battery returns 
below the load restore voltage, then that indicates only a temporary voltage 
surge and therefore the process returns to step 801 after the active priority is 
set equal to N-1 at step 805. In this case, since N is equal to four (N is always 
one greater than the active priority in the described embodiment), the active 
priority remains equal to three, in other words, no output devices are restored. 

[0109] If the battery voltage is still equal to or greater than the 
priority 3 load restore voltage at step 804, then the process proceeds to step 
806. At step 806, the control unit 14 determines whether any of the priority 3 
output devices 653 are inactive. If none of the priority 3 output devices are 
inactive, then N is decremented by one, and the process proceeds to step 801 . 
At step 801 , the control unit 14 determines whether the battery voltage has 
increased to the priority 2 load restore voltage. Thus, because the battery 
voltage has increased, but there were no priority 3 output devices 653 to 
restore at step 806, the control unit determines whether it is appropriate to start 
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restoring priority 2 output devices 652. The control unit 14 continues to search 
for a level of devices to restore until either the battery voltage is not high 
enough to justify restoring the next layer of devices (in which case the process 
proceeds to step 805, where the active priority is set equal to the highest level 
at which the battery voltage is high enough to permit restoring, if there were 
output devices to restore, and then the process returns to step 801) or until 
step 806 is answered affirmatively (in which case process proceeds to step 
808, where the active priority is set equal to the priority level at which output 
devices are available for restoring, and then the process proceeds to step 809). 

[0110] At step 809, these output devices are restored, the 
variable N is decremented, and the process proceeds to step 702 where the 
control unit 14 determines whether the battery voltage is greater than the load 
restore voltage of the next priority level. The process then continues until the 
battery voltage is less than the load restore voltage of the next priority level, or 
until all devices have been restored. Once a level of output devices has been 
restored, the control unit 14 starts accepting requests to turn on output devices 
having the restored priority level. 

[01 11] The implementation of the load manager 61 6 in the 
control unit 14 permits a high degree of flexibility to be obtained. For example, 
the priority level of output devices can be changed without requiring any 
hardware changes. For example, air conditioning might be given a higher priority 
in summer, when air conditioning is more critical for cooling off firefighters that 
have been inside a burning building, and less of a priority in winter when the 
outside temperature may be below freezing. 

[01 12] Further, the priority of the output devices can change 
dynamically as a function of the operating mode of the fire truck. Thus, in Fig. 
6, the output device 658 is illustrated as having a priority X. The variable X may 
be set equal to one value for most operating conditions. However, upon 
receiving a request for the output device 658, the central control unit can 
review the I/O state of the fire truck and, if predetermined I/O conditions are 
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met, give the output device 658 a higher load management priority level, 
thereby allowing the output device 658 to turn on. Because the load 
management priority level is a software-assigned value, and is not hardwired by 
relay logic, it is possible to change the load management priority level of output 
devices dynamically while the fire truck is operating at the scene of a fire, 

[01131 An additional advantage of the control system 12 is that 
it is more flexible and allows a higher level of load management granularity to be 
achieved. With the control system 12, it is possible to shed individual output 
devices instead of just groups of devices. For example, it is possible to shed 
individual lights within a lighting system without turning off the whole lighting 
system. 

[01 141 Another advantage of the control system 1 2 is that it can 
be given the ability to predict operational requirements of the fire truck, such 
that potential operational difficulties can be avoided. For example, with the load 
manager 61 6, the battery current draw may be monitored and very low priority 
loads may be preemptively shed in order to slow down or prevent the loss of 
battery power. 

[01 1 51 Another advantage of the control system 1 2 is that can 
be given the ability to perform prognoses of various system conditions and use 
the information obtained to alleviate or prevent operational difficulties. For 
example, the load manager 616 can predict, based on a knowledge of how 
much battery current is being drawn, how long the battery will last until it is 
necessary to start shedding output devices. Other examples also exist. For 
example, water flow from an on-board water supply can be monitored and the 
amount of time remaining until water is depleted can be displayed to an operator 
of the fire truck 1 0. This allows firefighters to know with greater accuracy how 
quickly they need to get the fire truck connected to a fire hydrant before the 
water supply is depleted. Similarly, for oxygen masks used in the basket of an 
aerial, oxygen flow can be monitored and the amount of time remaining until 
oxygen is depleted can be displayed to an operator of the fire truck. Again, this 
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allows firefighters to know with greater accuracy how quickly the oxygen 
supply should be replenished. Although conventionally, fire trucks have level 
indicators that indicate the amount of water or oxygen remaining, firefighters 
are generally more concerned about the amount of time remaining rather than 
the absolute quantity of water/oxygen remaining. This is especially true since 
the water and oxygen flow rates can vary significantly during the operation of 
the fire truck, 

c. Load Sequencing 

[0116] Referring now to Figs. 9, lOA, and 10B, a second 
example of the operation of the control system 1 2 is given. Figure 9 is another 
block diagram of the control system 12, which has been simplified to the extent 
that some of the structure shown in Figs. 1-2 is not shown in Fig. 9. 
Additionally, Fig. 6 shows a plurality of switches 941-45, a plurality of 
emergency lighting subsystems 951-54, and a plurality of LED indicators 955- 
59. The central control unit 14 includes a load sequencer 916, which is 
implemented in the control program 16 executed by the microprocessor 15. 

[0117] In Figs. 9, 10A and 10B, the operation of the load 
sequencer is described with respect to four emergency lighting subsystems 951- 
59. It may be noted that the load sequencer may be used in other situations to 
control other output devices. For example, another load sequencer may be used 
when battery power is first applied, and another when the ignition is first turned 
on. 

[0118] The lighting subsystems 951-59 may each, for example, 
comprise one emergency light or a set of emergency lights that are coupled to 
an output of one of the interface modules 30. Additionally, while only four 
subsystems are shown, in practice the load sequencer may be used to control 
additional emergency lighting subsystems. 

[0119] The switches 941, 942, 943 and 944 respectively control 
the emergency lights 951, 952, 953 and 954. The remaining switch 945 is the 
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E-master switch. For any given set of emergency lights, both the E-master 
switch and the respective switch 941-44 must be turned on. Initially, the 
previous active on/off states of the switches 941-44, which have been stored in 
non-volatile memory, are recalled. Then, when an emergency call is received, an 
operator activates the E-master switch 945. 

[0120] At step 1001 , E-master switch 945 transmits an input 
signal to the interface module 21 . At step 1002, the interface module processes 
the input signal. At step 1003, the interface module 21 transmits the input signal 
in the form of a network message to the central control unit 14. At step 1004, the 
central control unit processes input signal. 

[0121] At step 1005, the control unit causes blinking of the LED 
indicators 955-959 of the sequenced systems 951-954. In particular, the control 
unit transmits control signals (in the form of network messages) to the interface 
modules that are connected to the LED indicators 955-959, which in turn transmit 
the control signals to the LED indicators 955-959 themselves, in the manner 
previously described. The operation of the indicators 955-959 is the same as has 
previously been described, namely, the LED indicators 955-959 blink when the 
switches 941-44 are turned on but the lighting subsystems 951-954 are not 
turned on. As the subsystems 951-954 turn on one by one, so too do the led 
indicators 955-959. Accordingly, because the operation of the LED indicators 
955-959 indicators is the same as has been described elsewhere, the operation of 
the LED indicators 955-959 will not be described further. 

[0122] At step 1006, the central control unit generates first, 
second, third, fourth and fourth control signals. At step 1007, the central control 
unit 14 transmits the first control signal in the form of a network message to the 
interface module 35. At step 1008, the interface module 35 transmits the first 
control signal in the form of a power signal to the first emergency lighting 
subsystem 951 . 

[0123] The control unit 14 then transmits additional control signals 
at one-half second intervals. Thus, after a one-half second delay at step 1009, the 

-34- 

001.971601.1 



Atty. Dkt. No.: 61300/225 



central control unit transnnits the second control signal in the form a network 
message to the interface module 31 at step 1010. At step 101 1 , the interface 
module 31 then sends the second control signal in the form of a power signal to 
the second emergency lighting subsystem 952. After another one-half second 
delay at step 1012, the central control unit 14 transmits the third control signal in 
the form a network message to the interface module 34 at step 1013. At step 
1014, the interface module 34 then sends the third control signal in the form of a 
power signal to the third emergency lighting subsystem 953. Finally, after another 
one-half second delay at step 101 5, the central control unit 14 transmits the third 
control signal in the form a network message to the interface module 35 at step 
1016. At step 1017, the interface module 35 then sends the second control signal 
in the form of a power signal to the fourth emergency lighting subsystem 954. As 
previously indicated in connection with step 510 of Fig. 5, there are a variety of 
ways in which the blinking/flashing of outputs can be achieved, using either only a 
single control signal or using a first control signal followed by multiple additional 
control signals. 

[0124] Referring now to Figs, 1 1A and 1 1 B, another advantage 
of the control system 1 2 is the flexibility of the load sequencer 91 6. Like the 
load manager 61 6, the load sequencer 91 6 can operate as a function of the 
operating mode of the fire truck. Thus, in Fig. 1 1 A, the load sequencer 91 6 
turns subsystems on in a first order (1st, 2nd, 3rd, 4th, 5th, 6th) in a first 
operating mode of the fire truck 10. In a different operating mode of the fire 
truck, a somewhat different group of subsystems is load sequenced and they 
are load sequenced in a different order {3rd, 1st, 5th, 4th, 7th, 8th). The two 
different modes of operation can be activated, for example by two different 
master on/off switches. In the context of emergency lighting systems, this 
arrangement is useful where it is desirable to have the emergency lighting 
subsystems load sequence differently depending on whether the fire truck is 
traveling from the fire station to the fire or vice versa. 
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[0125] As another example of load sequencing performed as a 
function of the operating mode of the truck, it may be noted that, because the 
control unit 14 knows the on/off states of all of the output devices 50, load 
sequencing can be performed taking into account the current on/off state of the 
output devices that are load sequenced. For example, if some output devices are 
already turned on, then the load sequencer 916 can immediately proceed to the 
next output device without wasting time turning on a device that is already 
turned on. This advantageously permits load sequencing to be performed more 
quickly. 

3. Aerial Control 

[0126] Referring now to Fig. 12, a preferred embodiment of a fire 
truck 1210 with an aerial 1211 having an aerial control system 1212 is 
illustrated. By way of overview, the control system 1212 comprises an aerial 
central control unit 1214, a plurality of microprocessor-based interface modules 
1220, 1230 and 1235, a plurality of input devices 1240, and a plurality of 
output devices 1250. The central control unit 1214 and the interface modules 
1220, 1230 and 1235 are connected to each other by a communication 
network 1 260. 

[0127] The control system 1212 is similar in most respect to the 
control system 1 2, with the primary difference being that the control system 
1212 is used to control the output devices 1250 on the aerial 1211 based on 
input status information from the input devices 1240, rather than to control the 
output devices 50 on the chassis 1 1 . The interface modules 1 220 and 1 230 
may be identical to the interface modules 20 and 30, respectively, and the 
central control unit 1214 may be identical to the central control unit 14 except 
that a different control program is required in connection with the aerial 1211. 
Accordingly, the discussion above regarding the interconnection and operation 
of the interface modules 20 and 30 with the input devices 40 and output 
devices 50 applies equally to the central control unit 1214, except to the extent 
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that the control system 1212 is associated with the aerial 121 1 and not with 
the chassis 1 1 . 

[0128] The aerial control system 1212 also includes the interface 
modules 1225-27, which are similar to the interface modules 20 and 30 except 
that different I/O counts are utilized. In the preferred embodiment, the interface 
modules 1225-27 have twenty-eight switch inputs (two of which are 
configurable as frequency inputs). As previously noted, rather than using several 
different types of interface modules, it may be desirable to use only a single 
type of interface module in order to reduce inventory requirements. Additionally, 
the number of interface modules and the I/O counts are simply one example of a 
configuration that may be utilized. 

[01291 It is desirable to use a control system 1214 for the aerial 
1211 which is separate from the control system 1 2 in order to provide a clear 
separation of function between systems associated with the aerial 121 1 and 
systems associated with the chassis 1 1 . Additionally, as a practical matter, 
many fire trucks are sold without aerials and therefore providing a separate 
aerial control system enables a higher level commonality with respect to fire 
trucks that have aerials and fire trucks that do not have aerials. 

[0130] A specific example will now be given of a preferred 
interconnection of the interface modules with a plurality of output devices 1240 
and 1250. The interface module 1221 receives inputs from switches 1241a 
which may include for example an aerial master switch that activates aerial 
electrical circuits, an aerial PTO switch that activates the transmission to 
provide rotational input power for the hydraulic pump, and a platform leveling 
switch that momentarily activates a platform (basket) level electrical circuit to 
level the basket relative to the current ground grade condition. The LED 
indicators 1251 provide visual feedback regarding the status of the inputs 
switches 1 241 a. 

[0131] The interface modules 1225 and 1231 are located near a 
ground-level control station at a rear of the fire truck 10. The interface modules 
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1225 and 1231 receive inputs from switches 1242a and 1243a that include, for 
example, an auto level switch that activates a circuit to level the fire truck using 
the stabilizer jacks and an override switch that overrides circuits for emergency 
operation. The interface modules 1225 and 1231 may also receive inputs from 
an operator panel such as a stabilizer control panel 1242b, which includes 
switches that control the raising and lowering of front and rear stabilizer jacks, 
and the extending and retracting of front and rear stabilizer jacks. The stabilizer 
is an outrigger system which is deployed to prevent the fire truck from 
becoming unstable due to the deployment of an aerial system (e.g., an eighty- 
five foot extendable ladder). The interface module 1231 may drive outputs that 
\| are used to control deployment the stabilizer, which can be deployed anywhere 
d between zero and five feet. 

m 

^ [0132] The interface modules 1226 and 1232 are located near a 

turn table 1218 at the rear of the fire truck 10. The interface modules may 
receive inputs from switches 1244a and 1245a, as well as switches that are 

O 

O part of an aerial control panel 1245b and are used to control the 

extension/retraction, raising/lowering, and rotation of the aerial 121 1 . The 
interface modules 1226 and 1232 drive outputs that control the 
extension/retraction, raising/lowering, and rotation of the aerial 1211, as well as 
LED indicators 1254b that provide operator feedback, regarding the positions of 
switches and other I/O status information. The interface modules 1227 and 
1 233 are located in the basket of the aerial and provide duplicate control for the 
extension/retraction, raising/lowering, and rotation of the aerial. 

[0133] Additional inputs and outputs 1251b may be used to 
establish a communication link between the control system 12 and the control 
system 1212. In other words, the digital on/off outputs of one control system 
can be connected to the switch inputs of the other control system, and vice 
versa. This provides for a mechanism of transferring I/O status information back 
and forth between the two control systems 1211 and 1 21 2, 
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[0134] The control system 1214 has complete motion control of 
the aerial 1211. To this end, the control program 1216 includes an envelope 
motion controller 1216a, load motion controller 1216b and interlock controller 
1 21 6c. Envelope motion control refers to monitoring the position of the aerial 
and preventing the aerial from colliding with the remainder of the fire truck 10, 
and otherwise preventing undesirable engagement of mechanical structures on 
the fire truck due to movement of the aerial. Envelope motion control is 
implemented based on the known dimensions of the aerial 1211 and the known 
^! dimensions and position of other fire truck structures relative to the aerial 1211 
(e.g., the position and size of the cab 1 7 relative to the aerial 1211) and the 

ill 

SI position of the aerial 1 21 1 (which is measured with feedback sensors 1244a 
J:' and 1245a). The control system 1212 then disallows inputs that would cause 
^' the undesirable engagement of the aerial 121 1 with other fire truck structures. 

^] [01351 Load motion control refers to preventing the aerial from 

extending so far that the fire truck tips over due to unbalanced loading. Load 
motion control is implemented by using an appropriate sensor to measure the 
torque placed on the cylinder that mechanically couples the aerial 1211 to the 
remainder of the fire truck. Based on the torque and the known weight of the 
fire truck, it is determined when the fire truck is close to tipping, and warnings 
are provided to the operator by way of text messages and LED indicators. 

[0136] Interlock control refers to Implementing interlocks for 
aerial systems. For example, an interlock may be provided that require the 
parking brake be engaged before allowing the aerial to move, that require the 
stabilizers to be extended and set before moving the aerial 1211, that require 
that the aerial PTO be engaged before attempting to move the aerial, and so on. 

[0137] Advantageously, therefore, the control system makes the 
operation of the aerial much safer. For example, with respect to load motion 
control, the control system 1212 automatically alerts firefighters if the extension 
of the aerial is close to causing the fire truck to tip over. Factors such as the 
number and weight of people in the basket 1219, the amount and weight of 
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equipment in the basket 1219, the extent to which the stabilizers are deployed, 
whether and to what extent water is flowing through aerial hoses, and so on, 
are taken into account automatically by the torque sensors associated with the 
cylinder that mounts the aerial to the fire truck. This eliminates the need for a 
firefighter to have to monitor these conditions manually, and makes it possible 
for the control system 1212 to alert an aerial operator to unsafe conditions, and 
puts less reliance on the operator to make sure that the aerial is operating under 
safe conditions. 

4. Additional Aspects 

[0138] From the foregoing description, a number advantages of 
the preferred fire truck control system are apparent. In general, the control 
system is easier to use, more flexible, more robust, and more reliable than existing 
fire truck control systems. In addition, because of these advantages, the control 
system also increases firefighter safety because the many of the functions that 
were previously performed by firefighters are performed automatically, and the 
control system also makes possible features that would otherwise be impossible or 
at least impractical. Therefore, firefighters are freed to focus on fighting fires. 

[0139] The control system is easier to use because the control 
system provides a high level of cooperation between various vehicle 
subsystems. The control system can keep track of the mode of operation of the 
fire truck, and can control output devices based on the mode of operation. The 
functions that are performed on the fire truck are more fully integrated to 
provide a seamless control system, resulting in better performance. 

[0140] For example, features such as load management and load 
sequencing are implemented in the control program executed by the central 
control unit. No additional hardware is required to implement load management 
and load sequencing. Therefore, if it is desired to change the order of load 
sequencing, all that is required is to modify the control program. It is also possible 
to have different load sequencing defined for different modes of operation of the 
vehicle with little or no increase in hardware. The manner in which load 
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management is performed can also be changed dynamically during the operation of 
the fire truck. 

[0141] The control system is robust and can accept almost any 
new feature without changes in wiring. Switches are connected to a central 
control unit and not to outputs directly, and new features can be programmed 
into the control program executed by the central control unit. A system can be 
modified by adding a new switch to an existing interface module, or by 
modifying the function of an existing switch in the control program. Therefore, 
modifying a system that is already in use is easy because little or no wiring 
changes are required. 

[0142] Additionally, because the control system has access to 
input status information from most or all of the input devices on the fire truck and 
has control over most or all of the output devices on the fire truck, a high level of 
cooperation between the various subsystems on the fire truck is possible. Features 
that require the cooperation of multiple subsystems are much easier to implement. 

[0143] The fire truck is also easier to operate because there is 
improved operator feedback. Displays are provided which can be used to 
determine the I/O status of any piece of equipment on the vehicle, regardless of 
the location of the display. Additionally, the displays facilitate troubleshooting, 
because troubleshooting can be performed in real time at the scene of a fire 
when a problem is occurring. Troubleshooting is also facilitated by the fact that 
the displays are usable to display all of the I/O status information on the fire truck. 
There is no need for a firefighter to go to different locations on the fire truck to 
obtain required information. Troubleshooting is also facilitated by the provision of a 
central control unit which can be connected by modem to another computer. This 
allows the manufacturer to troubleshoot the fire truck as soon as problems arise. 

[0144] LED indicators associated with switches also improve 
operator feedback. The LEDs indicate whether the switch is considered to be off 
or on, or whether the switch is considered to be on but the output device 
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controlled by the switch is nevertheless off due to sonne other condition on the 
fire truck. 

[0145] . Because the control system is easier to use, firefighter 
safety is enhanced. When a firefighter is fighting fires, the firefighter is able to 
more fully concentrate on fighting the fire and less on having to worry about the 
fire truck. To the extent that the control system accomplishes tasks that otherwise 
would have to be performed by the firefighter, this frees the firefighter to fight 
fires. 

[0146] The control system is also more reliable and maintainable, 
in part because relay logic is replaced with logic implemented in a control program. 
The logic in the control program is much easier to troubleshoot, and 
troubleshooting can even occur remotely by modem. Also mechanical circuit 
breakers can be replaced with electronic control, thereby further reducing the 
number of mechanical failure points and making current control occur more 
seamlessly. The simplicity of the control system minimizes the number of 
potential failure points and therefore enhances reliability and maintainability. 

[0147] The system is also more reliable and more maintainable 
because there is less wire. Wiring is utilized only to established dedicated links 
between input/output devices and the interface module to which they are 
connected. The control system uses distributed power distribution and data 
collecting. The interface modules are interconnected by a network 
communication link instead of a hardwired link, thereby reducing the amount of 
wiring on the fire truck. Most wiring is localized wiring between the I/O devices 
and a particular interface module. 

[0148] Additionally, the interface modules are interchangeable 
units. In the disclosed embodiment, the interface modules 20 are 
interchangeable with each other, and the interface modules 30 are 
interchangeable with each other. If a greater degree of interchangeability is 
required, it is also possible to use only a single type of interface module. If the 
control system were also applied to other types of equipment service vehicles 
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(e.g., snow removal vehicles, refuse handling vehicles, cement/concrete mixers, 
military vehicles such as those of the multipurpose modular type, on/off road 
severe duty equipment service vehicles, and so on), the interface modules would 
even be made interchangeable across platforms since each interface module 
views the outside world in terms of generic inputs and outputs, at least until 
configured by the central control unit. Because the interface modules are 
interchangeable, maintainability is enhanced. An interface module that begins to 
malfunction due to component defects may be replaced more easily. On power 
up, the central control unit downloads configuration information to the new 
interface unit, and the interface unit becomes fully operational. This enhances 
the maintainability of the control system. 

[0149] Because the interface modules are microprocessor-based, 
the amount of processing required by the central control unit as well as the 
amount of communication that is necessary between the interface modules and 
the central control unit is reduced. The interface modules perform preprocessing 
of input signals and filter out less critical input signals and, as a result, the • 
central control unit receives and responds to critical messages more quickly. 

B. Military Vehicle Control System 

[0150] Referring now to Fig. 14, a preferred embodiment of a 
military vehicle 1410 having a control system 1412 is illustrated. As previously 
indicated, the control system described above can be applied to other types of 
equipment service vehicles, such as military vehicles, because the interface 
modules view the outside world in terms of generic inputs and outputs. Most or 
all of the advantages described above in the context of firefighting vehicles are 
also applicable to military vehicles. As previously described, however, it is 
sometimes desirable in the context of military applications for the military 
vehicle control system to be able to operate at a maximum level of effectiveness 
when the vehicle is damaged by enemy fire, nearby explosions, and so on. In this 
situation, the control system 1412 preferably incorporates a number of additional 
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features, discussed below, that increase the effectiveness of the control system 
1412 in these military applications. 

[0151] By way of overview, the control system 1412 comprises 
a plurality of microprocessor-based interface modules 1420, a plurality of input 
and output devices 1440 and 1450 (see Fig. 15) that are connected to the 
interface modules 1420, and a communication network 1460 that interconnects 
the interface modules 1420. The control system 1412 preferably operates in the 
same manner as the control system 1 2 of Figs. 1-13, except to the extent that 
differences are outlined are below. A primary difference between the control 
system 1 2 and the control system 1 41 2 is that the control system 1 41 2 does 
not include a central control unit that is implemented by a single device fixed at 
one location. Rather, the control system 1412 includes a central control unit 
that is allowed to move from location to location by designating one of the 
interface modules 1420 as a "master" interface module and by further allowing 
the particular interface module that is the designated master interface module to 
change in response to system conditions. As will be detailed below, this feature 
allows the control system 141 2 to operate at a maximum level of effectiveness 
when the military vehicle 1410 is damaged. Additional features that assist failure 
management are also included. 

[0152] More specifically, in the illustrated embodiment, the 
control system 1412 is used in connection with a military vehicle 1410 which is 
a multipurpose modular military vehicle. As is known, a multipurpose modular 
vehicle comprises a chassis and a variant module that is capable of being mounted 
on the chassis, removed, and replaced with another variant module, thereby 
allowing the same chassis to be used for different types of vehicles with different 
types of functionality depending on which variant module is mounted to the 
chassis. In the illustrated embodiment, the military vehicle 1410 is a wrecker and 
includes a wrecker variant module 1413 mounted on a chassis (underbody) 1417 
of the military vehicle 1410. The variant module 1413 is removable and 
replaceable with other types of variant modules, which may include a dump truck 
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variant, a water pump variant, a telephone variant, and so on. The I/O devices 
1440 and 1450 used by the vehicle 1410 include devices that are the same as 
or similar to the non-fire truck specific I/O devices of Figs. 1-13 (i.e., those 
types of I/O devices that are generic to most types of vehicles), as well as I/O 
devices that are typically found on the specific type of variant module chosen (in 
Fig. 14, a wrecker variant). 

[0153] The interface modules 1420 are constructed in generally 
the same manner as the interface modules 20 and 30 and each include a 
plurality of analog and digital inputs and outputs. The number and type of inputs 
and outputs may be the same, for example, as the vehicle interface modules 30. 
Preferably, as described in greater detail below, only a single type of interface 
module is utilized in order to increase the field serviceability of the control 
system 1412. Herein, the reference numeral 1420 is used to refer to the 
interface modules 1420 collectively, whereas the reference numerals 1421- 
1430 are used to refer to specific ones of the interface modules 1420. The 
interface modules are described in greater detail in connection with Figs. 15-18. 

[0154] Also connected to the communication network 1460 are 
a plurality of displays 1481 and 1482 and a data logger 1485. The displays 
1481 and 1482 permit any of the data collected by the control system 1412 to 
be displayed in real time, and also display warning messages. The displays 1481 
and 1482 also include membrane pushbuttons that allow the operators to scroll 
through, page through, or otherwise view the screens of data that are available. 
The membrane pushbuttons may also allow operators to change values of 
parameters in the control system 1412. The data logger 1485 is used to store 
information regarding the operation of the military vehicle 1410. The data logger 
1485 may also be used as a "black box recorder" to store information logged 
during a predetermined amount of time (e.g., thirty seconds) immediately prior 
to the occurrence of one or more trigger events (e.g., events indicating that the 
military vehicle 1410 has been damaged or rendered inoperative, such as when 
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an operational parameter such as an acceleronneter threshold has been 
exceeded). 

[0155] Finally, Fig. 14 shows an engine system including an 
engine 1491 and an engine control system 1492, a transmission system 
including a transmission 1493 and a transmission control system 1494, and an 
anti-lock brake system including an anti-lock brake control system 1495. These 
systems may be interconnected with the control system 1412 in generally the 
same manner as discussed above in connection with the engine 91, the engine 
control system 92, the transmission 93, the transmission control system 94, 
and the anti-lock brake system 95 of Fig. 1 . 

[0156] Referring now also to Fig. 15-18, the structure and 
interconnection of the interface modules 1420 is described in greater detail. 
Referring first to Fig. 15, the interconnection of the interface modules 1420 
with a power source 1500 is described. The interface modules 1420 receive 
power from the power source 1 500 by way of a power transmission link 1 502. 
The interface modules 1420 are distributed throughout the military vehicle 
1410, with some of the interface modules 1420 being located on the chassis 
1417 and some of the interface modules 1420 being located on the variant 
module 1413. 

[0157] The control system is subdivided into three control 
systems including a chassis control system 1511, a variant control system 
1512, and an auxiliary control system 1513. The chassis control system 151 1 
includes the interface modules 1421-1425 and the I/O devices 1441 and 1451, 
which are all mounted on the chassis 1417. The variant control system 1512 
includes the interface modules 1426-1428 and the I/O devices 1442 and 1452, 
which are all mounted on the variant module 1413. The auxiliary control system 
1513 includes the interface modules 1429-1430 and the I/O devices 1443 and 
1 453, which may be mounted on either the chassis 1 41 7 or the variant module 
141 3 or both. 
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[0158] The auxiliary control system 1513 may, for example, be 
used to control a subsystem that is disposed on the variant module but that is 
likely to be the same or similar for all variant modules (e.g., a lighting subsystem 
that includes headlights, tail lights, brake lights, and blinkers). The inclusion of 
interface modules 1420 within a particular control system may also be 
performed based on location rather than functionality. For example, if the variant 
module 1413 has an aerial device, it may be desirable to have one control 
system for the chassis, one control system for the aerial device, and one control 
system for the remainder of the variant module. Additionally, although each 
interface module 1420 is shown as being associated with only one of the 
control systems 1 51 1 -1 5 1 3, it is possible to have interface modules that are 
associated with more than one control system. It should also be noted that the 
number of sub-control systems, as well as the number of interface modules, is 
likely to vary depending on the application. For example, a mobile command 
vehicle is likely to have more control subsystems than a wrecker variant, given 
the large number of I/O devices usually found on mobile command vehicles. 

[0159] The power transmission link 1502 may comprise a single 
power line that is routed throughout the military vehicle 1410 to each of the 
interface modules 1420, but preferably comprises redundant power lines. Again, 
in order to minimize wiring, the interface modules 1420 are placed so as to be 
located as closely as possible to the input devices 1440 from which input status 
information is received and the output devices 1450 that are controlled. This 
arrangement allows the previously-described advantages associated with 
distributed data collection and power distribution to be achieved. Dedicated 
communication links, which may for example be electric or photonic links, 
connect the interface modules 1421-1430 modules with respective ones of the 
I/O devices, as previously described. 

[0160] Referring next to Fig. 1 6, the interconnection of the 
interface modules 1420 by way of the communication network 1460 is 
illustrated. As previously indicated, the control system 1412 is subdivided into 
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three control systems 1511, 1512 and 1513. In accordance with this 
arrangement, the communication network 1460 is likewise further subdivided 
into three communication networks 1661, 1662, and 1663, The communication 
network 1661 is associated with the chassis control system 151 1 and 
interconnects the interface modules 1421-1425. The communication network 

1662 is associated with the variant control system 1512 and interconnects the 
interface modules 1426-1428. The communication network 1663 is associated 
with the auxiliary control system 1513 and interconnects the interface modules 
1429-1430. Communication between the control systems 1511-1513 occurs by 
way of interface modules that are connected to multiple ones of the networks 
1661-1663. Advantageously, this arrangement also allows the interface 
modules to reconfigure themselves to communicate over another network in the 
event that part or all of their primary network is lost. For example, in Fig. 1 7A, 
when a portion of the communication network 1663 is lost, the interface 
module 1429 reconfigures itself to communicate with the interface module 
1430 by way of the communication network 1662 and the interface module 
1427. 

[0161] In practice, each of the communication networks 1661- 

1663 may be formed of two or more communication networks to provide 
redundancy within each control system. Indeed, the connection of the various 
interface modules 1420 with different networks can be as complicated as 
necessary to obtain the desired level of redundancy. For simplicity, these 
potential additional levels of redundancy will be ignored in the discussion of Fig. 
16 contained herein. 

[0162] The communication networks 1661-1663 may be 
implemented in accordance with SAE J1 708/1 587 and/or J1939 standards, or 
some other network protocol, as previously described. The transmission medium 
is preferably fiber optic cable in order to reduce the amount of electromagnetic 
radiation that the military vehicle 1410 produces, therefore making the vehicle 
less detectable by the enemy. Fiber optic networks are also more robust to the 
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extent that a severed fiber optic cable is still usable to create two independent 
networks, at least with reduced functionality. 

[0163] When the variant module 1413 is mounted on the chassis 
1417, connecting the chassis control system 151 1 and the variant control 
system 1512 is achieved simply through the use of two mating connectors 
1681 and 1682 that include connections for one or more communication 
busses, power and ground. The chassis connector 1682 is also physically and 
functionally mateable with connectors for other variant modules, i.e., the 
chassis connector and the other variant connectors are not only capable of 
mating physically, but the mating also produces a workable vehicle system. A 
given set of switches or other control devices 1651 on the dash (see Fig. 14) 
may then operate differently depending on which variant is connected to the 
chassis. Advantageously, therefore, it is possible to provide a single interface 
between the chassis and the variant module (although multiple interfaces may 
also be provided for redundancy). This avoids the need for a separate connector 
on the chassis for each different type of variant module, along with the 
additional unutilized hardware and wiring, as has conventionally been the 
approach utilized. 

[0164] Upon power up, the variant control system 1512 and the 
chassis control system 1511 exchange information that is of interest to each 
other. For example, the variant control system 1512 may communicate the 
variant type of the variant module 1413. Other parameters may also be 
communicated. For example, information about the weight distribution on the 
variant module 1413 may be passed along to the chassis control system 1511, 
so that the transmission shift schedule of the transmission 1493 can be 
adjusted in accordance with the weight of the variant module 141 3, and so that 
a central tire inflation system can control the inflation of tires as a function of 
the weight distribution of the variant. Similarly, information about the chassis 
can be passed along to the variant. For example, where a variant module is 
capable of being used by multiple chassis with different engine sizes, engine 
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information can be connnnunicated to a wrecker variant nnodule so that the 
wrecker variant knows how nnuch weight the chassis is capable of pulling. Thus, 
an initial exchange of information in this manner allows the operation of the 
chassis control system 1511 to be optimized in accordance with parameters of 
the variant module 1413, and vice versa. 

[0165] It may also be noted that the advantages obtained for 
military variants can also be realized in connection with commercial variants. 
Thus, a blower module, a sweeper module, and a plow module could be 
provided for the same chassis. This would allow the chassis to be used for a 
sweeper in summer and a snow blower or snow plow in winter. 

[0166] As shown in Fig. 1 6, each control system 1511-1513 
includes an interface module that is designated "master" and another that is 
designated "deputy master." Thus, for example, the chassis control system 
151 1 includes a master interface module 1423 and a deputy master interface 
module 1422. Additional tiers of mastership may also be implemented in 
connection with the interface modules 1421, 1424 and 1425. 

[0167] The interface modules 1420 are assigned their respective 
ranks in the tiers of mastership based on their respective locations on the 
military vehicle 1410. A harness connector at each respective location of the 
military vehicle 1410 connects a respective one of the interface modules 1420 
to the remainder of the control system 1412. The harness connector is 
electronically keyed, such that being connected to a particular harness 
connector provides an interface module 1420 with a unique identification code 
or address M. For simplicity, the value M is assumed to be a value between 1 
and N, where N is the total number of interface modules on the vehicle (M = 10 
in the illustrated embodiment). 

[0168] The interface modules 1420 each store configuration 
information that, among other things, relates particular network addresses with 
particular ranks of mastership. Thus, for example, when the interface module 
1423 boots up, it ascertains its own network address and, based on its network 
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address, ascertains that it is the master of the control systenn 1511. The 
interface module 1423 serves as the central control unit so long as the interface 
module 1423 is competent to do so. As shown in Fig. 17B, if it is determined 
that the interface module 1423 is no longer competent to serve as master (e.g., 
because the interface module 1423 has been damaged in combat), then the 
interface module 1422 becomes the master interface module and begins serving 
as the central control unit. This decision can be made, for example, by the 
interface module 1423 itself, based on a vote taken by the remaining interface 
modules 1420, or based on a decision by the deputy master. 

[0169] Referring next to Fig. 18, an exemplary one of the 
interface modules 1420 is shown in greater detail. The interface modules 1420 
each include a microprocessor 1815 that is sufficiently powerful to allow each 
interface module to serve as the central control unit. The interface modules are 
identically programmed and each include a memory 1831 that further includes a 
program memory 1832 and a data memory 1834. The program memory 1832 
includes BIOS (basic input/output system) firmware 1836, an operating system 
1838, and application programs 1840, 1842 and 1844. The application 
programs include a chassis control program 1840, one or more variant control 
programs 1842, and an auxiliary control program 1844. The data memory 1834 
includes configuration information 1846 and I/O status information 1848 for all 
of the modules 1420-1430 associated with the chassis 1417 and its variant 
module 1413, as well as configuration information for the interface modules 
(N + 1 to Z in Fig. 1 8) of other variant modules that are capable of being 
mounted to the chassis 1417. 

[01701 It is therefore seen that all of the interface modules 1420 
that are used on the chassis 1417 and its variant module 1413, as well as the 
interface modules 1 420 of other variant modules that are capable of being 
mounted to the chassis 1417, are identically programmed and contain the same 
information. Each interface module 1420 then utilizes its network address to 
decide when booting up which configuration information to utilize when 
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configuring itself, and which portions of the application programs 1840-1844 to 
execute given its status as a master or non-master member of one of the control 
systems 1511-1513. The interface modules are both physically and functionally 
interchangeable because the interface modules are capable of being plugged in 
at any slot on the network, and are capable of performing any functions that are 
required at that slot on the network. 

[0171] This arrangement is highly advantageous. Because all of 
the interface modules 1420 are identically programmed and store the same 
information, the interface modules are physically and functionally 
interchangeable within a given class of vehicles. Thus, if an interface module 
1420 on one variant module is rendered inoperative, but the variant module is 
otherwise operational, the inoperative interface module can be replaced with an 
interface module scavenged from another inoperative vehicle. When the 
replacement interface module 1420 reboots, it will then reconfigure itself for use 
in the new vehicle, and begin operating the correct portions of the application 
programs 1840-1844. This is the case even when the two vehicles are different 
types of vehicles. 

[0172] Additionally, if a highly critical interface module is 
rendered inoperable, the highly critical interface module can be swapped with an 
interface module that is less critical. Although the input/output devices 
associated with the less critical interface module will no longer be operable, the 
input/output devices associated with the more critical interface module will be 
operable. This allows the effectiveness of the military vehicle to be maximized 
by allowing undamaged interface modules to be utilized in the most optimal 
manner. In this way, the field serviceability of the control system 1412 is 
dramatically improved. Further, the field serviceability of the control system 
1412 is also improved by the fact that only a single type of interface module is 
used, because the use of a single type of interface module makes it easier to 
find replacement interface modules. 
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[0173] Additionally, as previously noted, each interface module 
1420 stores I/O status information for all of the modules 1420-1430 associated 
with the chassis 1417 and its variant module 1413. Therefore, each interface 
module 1420 has total system awareness. As a result, it is possible to have 
each interface module 1420 process its own inputs and outputs based on the 
I/O status information in order to increase system responsiveness and in order to 
reduce the amount of communication that is required with the central control 
unit. The main management responsibility of the central control unit or master 
interface module above and beyond the responsibilities of all the other interface 
modules 1420 then becomes, for example, to provide a nexus for interface 
operations with devices that are external to the control system of which the 
central control unit is a part. 



3 [0174] Referring now to Fig. 19, Fig. 1 9 is a truth table that 



describes the operation of the control system 141 2 in the event of failure of one 
of the interface modules 1420 and/or one of the input devices 1440. The 
arrangement shown in Fig. 19 allows the control system 141 2 to be able to 
continue to operate in the event of failure using a "best guess" method of 
controlling outputs. 

[0175] In the example of Fig. 19, two output devices are controlled 
based on two input devices. For example, the first output device may be 
headlights of the military vehicle 1410, the first input device may be a combat 
switch or combat override switch that places the entire vehicle into a combat 
mode of operation, and the second input may be an operator switch for operator 
control of the headlights. The second output device is discussed further below. For 
simplicity, only the input states of two binary input devices are shown. In practice, 
of course, the control logic for most output devices will usually be a function of 
more input devices, in some cases ten or more input devices including analog input 
devices. Nevertheless, the simplified truth table of Fig. 19 is sufficient to obtain an 
understanding of this preferred aspect of the invention. 
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[01761 The truth table of Fig. 1 9 shows a number of different 
possible input states and the corresponding output states. In the first two states, 
when the combat override switch (input #1) is off, then the headlights (output #1) 
are controlled as a function of the operator switch. Thus, if the operator switch is 
on, then the control system 1 41 2 turns the headlights on, and if the operator 
switch is off, then the control system 141 2 turns the headlights off. In the third 
and fourth input states, the combat override switch is on, and therefore the 
control system 1412 turns the headlights off in order to make the vehicle less 
detectable by the enemy. It may be noted that the control system 1 41 2 ignores 
the input state of the second input device when the combat override switch is on. 
The third column in the truth table could therefore instead be the output of a 
safety interlock, since safety interlocks are another example of input information 
that is sometimes ignored when a combat override is turned on. This would allow 
the control system 141 2 to take into account the urgency of a combat situation 
while still also implementing safety functions to the extent that they do not 
interfere with the operation of the vehicle 1410. 

[0177] The truth table also has a number of additional states (five 
through nine) corresponding to situations in which one or both of the inputs is 
designated as undetermined {"7" in Fig. 19). Thus, for example, in states five and 
six, the input state of the operator switch (input #2) is designated as 
undetermined. The undetermined state of the operator switch may be the result of 
the failure of the interface module that receives the input signal from the operator 
switch, a failure of the electrical connection between the switch and the interface 
module, and/or a failure of the operator switch itself. In the fifth state, when the 
combat override switch is off and the state of the operator switch is 
undetermined, the control system 1412 turns on the headlights, based on the 
assumption that if it is nighttime the operator wants the lights on and if it is 
daytime the operator does not have a strong preference either way. In the sixth 
state, when the combat override switch is on and the state of the operator switch 
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is undetermined, the control system 1412 turns off the headlights, because the 
headlights should always be turned off in the combat mode of operation. 

[0178] In states seven through nine, the input state of the combat 
override switch (input #1) is designated as undetermined. The undetermined state 
of the combat override switch may be caused by generally the same factors that 
are liable to cause the state of the operator switch to be undetermined. In all of 
these states, the control system 1412 turns off the headlights, based on the worst 
case assumption that the military vehicle may be in combat and that therefore the 
headlights should be turned off. 

[0179] The arrangement shown in Fig. 1 9 is thus applied to all 
output devices 1450 on the military vehicle. In this way, the control logic for 
controlling the output devices is expanded to take into account a third 
"undetermined'' state for each of the input devices, and an entire additional layer 
of failure management is added to the control logic. In this way, the control 
system 1412 is able to remain operational (at least in a best guess mode) when 
the input states of one or more input devices cannot be determined. This 
prevents output devices that have an output state based on the input state of a 
given input device from being crippled when a system failure causes one or 
more input devices to be lost. 

[0180] This arrangement also allows the output state of each 
output device to be programmed individually in failure situations. In other words, 
when a given input device is lost, the control system can be programmed to 
assume for purposes of some output devices (using the above described truth 
table arrangement) that the input device is on and to assume for the purposes of 
other output devices that the input device is off. For example, in Fig. 1 9, if 
output device #2 is another output device that is controlled by the same 
operator switch, the control system can be programmed to assume for purposes 
of output device #2 that the operator switch is off in state five rather than on, 
such that the control system turns off the output device #2 in state five. In this 
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way, it is not necessary to assume the same input state for purposes of all 
output devices. 

[0181] It may also be noted that military vehicles tend to make 
widespread use of redundant sensors. In this case, by connecting the redundant 
sensors to different ones of the interface modules, the state table for each 
output device can be modified to accept either input, thereby making it possible 
for the control system 141 2 to obtain the same information by a different route. 
Further, if the redundant sensors disagree on the input status of a system 
parameter, then this disagreement itself can be treated as an undetermined input 
state of an input device. In this way, rather than using a voting procedure in 
which the sensors vote on the state of the input device for purposes of all 
output devices, the uncertainty can be taken into account and best guess 
decisions regarding how to operate can be made for each of the various output 
devices individually. 

[0182] As previously described, each interface module 1420 has 
total system awareness. Specifically, the data memory 1834 of each interface 
module 1420 stores I/O status information 1848 for not only local I/O devices 
1440 and 1450 but also for non-local I/O devices 1440 and 1450 connected to 
remaining ones of the interface modules 1420. Referring now to Figs. 20-23, a 
preferred technique for transmitting I/O status information between the interface 
modules 1420 will now be described. Although this technique is primarily 
described in connection with the chassis control system 1511, this technique is 
preferably also applied to the variant control system 1512 and the auxiliary control 
system 1513, and/or in the control system 12. 

[0183] Referring first to Fig. 20, as previously described, the 
chassis control system 1511 includes the interface modules 1421-1425, the 
input devices 1441, and the output devices 1451. Also shown in Fig. 20 are 
the display 1481, the data logger 1485, and the communication network 1661 
which connects the interface modules 1421-1425. In practice, the system may 
include additional devices, such as a plurality of switch interface modules 
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connected to additional I/O devices, which for simplicity are not shown. The 
switch interface modules may be the same as the switch interface modules 20 
previously described and, for example, may be provided in the form of a 
separate enclosed unit or in the more simple form of a circuit board mounted 
with associated switches and low power output devices. In practice, the 
system may include other systems, such as a display interface used to drive one 
or more analog displays (such as gauges) using data received from the 
communication network 1661 . Any additional modules that interface with I/O 
devices preferably broadcast and receive I/O status information and exert local 
control in the same manner as detailed below in connection with the interface 
modules 1421-1425. As previously noted, one or more additional 
communication networks may also be included which are preferably 
implemented in accordance with SAE J 1708/1 587 and/or J1939 standards. 
The communication networks may be used, for example, to receive I/O status 
information from other vehicle systems, such as an engine or transmission 
control system. Arbitration of I/O status broadcasts between the 
communication networks can be performed by one of the interface modules 
1420. 

[0184] To facilitate description, the input devices 1441 and the 
output devices 1451 have been further subdivided and more specifically labeled 
in Fig. 20. Thus, the subset of the input devices 1441 which are connected to 
the interface module 1421 are collectively labeled with the reference numeral 
1541 and are individually labeled as having respective input states 1-1 1 to 1-15. 
Similarly, the subset of the output devices 1451 which are connected to the 
interface module 1421 are collectively labeled with the reference numeral 1551 
and are individually labeled as having respective output states 0-1 1 to 0-15. A 
similar pattern has been followed for the interface modules 1422-1425, as 
summarized in Table I below: 
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Interface 


Input 


Input 


Output 


Output 


Module 


Devices 


States 


Devices 


States 


1421 


1541 


1-1 1 to 1-15 


1551 


0-1 1 to 0-15 


1422 


1542 


1-21 to 1-25 


1552 


0-21 to 0-25 


1423 


1543 


1-31 to 1-35 


1553 


0-31 to 0-35 


1424 


1544 


1-41 to 1-45 


1554 


0-41 to 0-45 


1425 


1545 


1-51 to 1-55 


1555 


0-51 to 0-55 



Table I 

[0185] Of course, although five input devices 1441 and five 
output devices 1451 are connected to each of the interface modules 1420 in 
the illustrated embodiment, this number of I/O devices is merely exemplary and 
a different number of devices could also be used, as previously described. 

[0186] The interface modules 1420 each comprise a respective 
I/O status table 1520 that stores information pertaining to the I/O states of the 
input and output devices 1441 and 1451 . Referring now to Fig. 21 , an 
exemplary one of the I/O status tables 1520 is shown. As shown in Fig. 21, 
the I/O status table 1 520 stores I/O status information pertaining to each of the 
input states 1-1 1 to 1-15, 1-21 to 1-25, 1-31 to 1-35, 1-41 to 1-45, and 1-51 to 1-55 
of the input devices 1541-1545, respectively, and also stores I/O status 
information pertaining to each of the output states 0-1 1 to 0-15, 0-21 to 0-25, 
0-31 to 0-35, 0-41 to 0-45, and 0-51 to 0-55 of the output devices 1551 to 
1 555, respectively. The I/O status tables 1 520 are assumed to be identical, 
however, each I/O status table 1520 is individually maintained and updated by 
the corresponding interface module 1420. Therefore, temporary differences 
may exist between the I/O status tables 1520 as updated I/O status information 
is received and stored. Although not shown, the I/O status table 1520 also 
stores I/O status information for the interface modules 1 426-1 428 of the variant 
control system 1512 and the interface modules 1429-1430 of the auxiliary 
control system 1513. 
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[0187] In practice, although Fig. 21 shows the I/O status 
information being stored next to each other, the nnemory locations that store the 
I/O status information need not be contiguous and need not be located in the 
same physical media. It may also be noted that the I/O status table 1520 is, in 
practice, implemented such that different I/O states are stored using different 
amounts of memory. For example, some locations store a single bit of 
information (as in the case of a digital input device or digital output device) and 
other locations store multiple bits of information (as in the case of an analog 
input device or an analog output device). The manner in which the I/O status 
table is implemented is dependent on the programming language used and on 
the different data structures available within the programming language that is 
used. In general, the term I/O status table is broadly used herein to encompass 
any group of memory locations that are useable for storing I/O status 
information. 

[0188] Also shown in Fig. 21 are a plurality of locations that 
store intermediate status information, labeled IM-11, IM-21, IM-22, and IM-41. 
The intermediate states IM-1 1, IM-21, IM-22, and IM-41 are processed versions 
of selected I/O states. For example, input signals may be processed for 
purposes of scaling, unit conversion and/or calibration, and it may be useful in 
some cases to store the processed I/O status information. Alternatively, the 
intermediate states IM-1 1, IM-21, IM-22, and IM-41 may be a function of a 
plurality of I/O states that in combination have some particular significance, the 
processed I/O status information is then transmitted to the remaining interface 
modules 1420. 

[0189] Referring now to Figs. 22-23, Fig. 22 is a flowchart 
describing the operation of the control system of Fig. 20, and Fig. 23 is a data 
flow diagram describing data flow through an exemplary interface module during 
the process of Fig. 22. As an initial matter, it should be noted that although 
Fig. 22 depicts a series of steps which are performed sequentially, the steps 
shown in Fig. 22 need not be performed in any particular order. In practice, for 
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example, modular programming techniques are used and therefore some of the 
steps are performed essentially simultaneously. Additionally, it may be noted 
that the steps shown in Fig. 22 are performed repetitively during the operation 
of the interface module 1421, and some of the steps are in practice performed 
more frequently than others. For example, input information is acquired from 
the input devices more often than the input information is broadcast over the 
communication network. Although the process of Fig. 22 and the data flow 
diagram of Fig. 23 are primarily described in connection with the interface 
module 1421, the remaining interface modules 1422-1425 operate in the same 
manner. 

[0190] At step 1852, the interface module 1421 acquires input 
status information from the local input devices 1541 . The input status 
information, which pertains to the input states 1-1 1 to 1-15 of the input devices 
1541, is transmitted from the input devices 1541 to the interface module 1421 
by way of respective dedicated communication links, as previously described in 
connection with Figs. 2-3, At step 1854, the input status information acquired 
from the local input devices 1 541 is stored in the I/O status table 1 520 at a 
location 1531. For the interface module 1 421 , the I/O devices 1541 and 1551 
are referred to as local I/O devices since the I/O devices 1 541 and 1 551 are 
directly coupled to the interface module 1421 by way of respective dedicated 
communication links, as opposed to the remaining non-local I/O devices and 
1542-1545 and 1552-1555 which are indirectly coupled to the interface module 
1 421 by way of the communication network 1 661 . 

[0191] At step 1856, the interface module 1421 acquires I/O 
status information for the non-local input devices 1542-1545 and the non-local 
output devices 1 552-1 555 by way of the communication network 1 661 . 
Specifically, the interface module 1421 acquires input status information 
pertaining to the input states 1-21 to 1-25, 1-31 to 1-35, 1-41 to 1-45, 1-51 to 1-55 
of the input devices 1542-1545, respectively, and acquires output status 
information pertaining to the output states 0-21 to 0-25, 0-31 to 0-35, 0-41 to 
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0-45, 0-51 to 0-55 of the output devices 1552-1555. The input status 
information and the output status information are stored in locations 1 533 and 
1534 of the I/O status table 1 520, respectively. 

[0192] At step 1860, the interface module 1421 determines 
desired output states 0-1 1 to 0-1 5 for the output devices 1 551 . As previously 
noted, each of the interface modules 1420 stores a chassis control program 
1840, one or more variant control programs 1842, and an auxiliary control 
program 1844. The interface module 1421 is associated with the chassis 
control system 1511 and, therefore, executes a portion of the chassis control 
program 1 840. (The portion of the chassis control program 1 840 executed by 
the interface module 1421 is determined by the location of the interface module 
1421 on the military vehicle 1410, as previously described.) The interface 
module 1421 executes the chassis control program 1840 to determine the 
desired output states 0-1 1 to 0-15 based on the I/O status information stored in 
the I/O status table 1520. Preferably, each interface module 1420 has complete 
control of its local output devices 1450, such that only I/O status information is 
transmitted on the communication network 1460 between the interface modules 
1420. 

[0193] At step 1862, the interface module 1421 controls the 
output devices 1551 in accordance with the desired respective output states 
0-1 1 to 0-15. Once the desired output state for a particular output device 
1551 has been determined, control is achieved by transmitting a control signal 
to the particular output device 1551 by way of a dedicated communication link. 
For example, if the output is a digital output device (e.g., a headlight controlled 
in on/off fashion), then the control signal is provided by providing power to the 
headlight by way of the dedicated communication link. Ordinarily, the actual 
output state and the desired output state for a particular output device are the 
same, especially in the case of digital output devices. However, this is not 
always the case. For example, if the headlight mentioned above is burned out, 
the actual output state of the headlight may be "off," even though the desired 
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output state of the light is "on." Alternatively, for an analog output device, the 
desired and actual output states may be different if the control signal is not 
properly calibrated for the output device. 

[0194] At step 1864, the interface module 1421 stores output 
status information pertaining to the desired output states 0-1 1 to 0-1 5 for the 
output devices 1551 in the I/O status table 1520. This allows the output states 
0-1 1 to 0-1 5 to be stored prior to being broadcast on the communication 
network 1661. At step 1866, the interface module 1421 broadcasts the input 
status information pertaining to the input states 1-1 1 to 1-1 5 of the input devices 
1541 and the output status information pertaining to the output states 0-1 1 to 
0-15 of the output devices 1551 over the communication network 1661 . The 
I/O status information is received by the interface modules 1422-1425. Step 
1866 is essentially the opposite of step 1856, in which non-local I/O status 



^1 information is acquired by the interface module 1421 by way of the 



^: communication network 1661 . In other words, each interface module 1420 

a 

O broadcasts its portion of the I/O status table 1520 on the communication 



network 1661, and monitors the communication network 1661 for broadcasts 
from the remaining interface modules 1420 to update the I/O status table 1 520 
to reflect updated I/O states for the non-local I/O devices 1441 and 1451 . In 
this way, each interface module 1420 is able to maintain a complete copy of the 
I/O status information for all of the I/O devices 1441 and 1451 in the system. 

[0195] The interface modules 1423 and 1425 are used to 
transmit I/O status information between the various control systems 1511- 
1513. Specifically, as previously noted, the interface module 1423 is 
connected to both the communication network 1661 for the chassis control 
system 1511 and to the communication network 1662 for the variant control 
system 1512 (see Fig. 16), The interface module 1423 is preferably utilized to 
relay broadcasts of I/O status information back and forth between the interface 
modules 1421-1425 of the chassis control system 151 1 and the interface 
modules 1426-1428 of the variant control system 1512. Similarly, the interface 
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module 1425 is connected to both the comnriunication network 1661 for the 
chassis control system 151 1 and the to the communication network 1663 for 
the auxiliary control system 1513 (see Fig. 16), and the interface module 1425 
is preferably utilized to relay broadcasts of I/O status information back and forth 
between the interface modules 1421-1425 of the chassis control system 1511 
and the interface modules 1429-1430 of the auxiliary control system 1513. 

[0196] The arrangement of Figs. 20-23 is advantageous because 
it provides a fast and efficient mechanism for updating the I/O status 
information 1 848 stored in the data memory 1 834 of each of the interface 
modules 1420. Each interface module 1420 automatically receives, at regular 
intervals, complete I/O status updates from each of the remaining interface 
modules 1420. There is no need to transmit data request (polling) messages 
and data response messages (both of which require communication overhead) to 
communicate information pertaining to individual I/O states between individual 
I/O modules 1420. Although more I/O status data is transmitted, the 
transmissions require less overhead and therefore the overall communication 
bandwidth required is reduced. 

[0197] This arrangement also increases system responsiveness. 
First, system responsiveness is improved because each interface module 1420 
receives current I/O status information automatically, before the information is 
actually needed. When it is determined that a particular piece of I/O status 
information is needed, there is no need to request that information from another 
interface module 1420 and subsequently wait for the information to arrive via 
the communication network 1661. The most current I/O status information is 
already assumed to be stored in the local I/O status table 1 520. Additionally, 
because the most recent I/O status information is always available, there is no 
need to make a preliminary determination whether a particular piece of I/O 
status information should be acquired. Boolean control laws or other control 
laws are applied in a small number of steps based on the I/O status information 
already stored in the I/O status table 1 520. Conditional control loops designed 
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to avoid unnecessarily acquiring I/O status infornnation are avoided and, 
therefore, processing time is reduced. 

[0198] It nnay also be noted that, according to this arrangennent, 
there is no need to synchronize the broadcasts of the interface modules 1420. 
Each interface module 1420 monitors the communication network 1661 to 
determine if the communication network 1661 is available and, if so, then the 
interface module broadcasts the I/O status information for local I/O devices 
1441 and 1451 . (Standard automotive communication protocols such as SAE 
J 1708 or J1 939 provide the ability for each member of the network to monitor 
the network and broadcast when the network is available.) Although it is 
desirable that the interface modules rebroadcast I/O status information at 
predetermined minimum intervals, the broadcasts may occur asynchronously. 

[0199] The technique described in connection with Figs. 20-23 
also provides an effective mechanism for detecting that an interface module 
1420 has been rendered inoperable, for example, due to damage incurred in 
combat. As just noted, the interface modules 1420 rebroadcast I/O status 
information at predetermined minimum intervals. Each interface module 1420 
also monitors the amount of time elapsed since an update was received from 
each remaining interface module 1420. Therefore, when a particular interface 
module 1420 is rendered inoperable due to combat damage, the inoperability of 
the interface module 1420 can be detected by detecting the failure of the 
interface module 1 420 to rebroadcast its I/O status information within a 
predetermined amount of time. Preferably, the elapsed time required for a 
particular interface module 1420 to be considered inoperable is several times the 
expected minimum rebroadcast time, so that each interface module 1420 is 
allowed a certain number of missed broadcasts before the interface module 
1420 is considered inoperable. A particular interface module 1420 may be 
operable and may broadcast I/O status information, but the broadcast may not 
be received by the remaining interface modules 1420 due, for example, to noise 
on the communication network. 
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[0200] This arrangement also simplifies the operation of the data 
logger 1485 and automatically permits the data logger 1485 to store I/O status 
information for the entire control system 1412. The data logger 1485 monitors 
the communication network 1661 for I/O status broadcasts in the same way as 
the interface modules 1420. Therefore, the data logger 1485 automatically 
receives complete system updates and is able to store these updates for later 
use. 

[0201] As previously noted, in the preferred embodiment, the 
interface modules 1423 and 1425 are used to transmit I/O status information 
between the various control. systems 151 1-1513. In an alternative 
arrangement, the interface module 1429 which is connected to all three of the 
communication networks 1661-1663 could be utilized instead. Although less 
preferred, the interface module 1429 may be utilized to receive I/O status 
information from each of the interface modules 1421-1428 and 1430, assemble 
the I/O status data into an updated I/O status table, and then rebroadcast the 



p entire updated I/O status table 1 520 to each of the remaining interface modules 



1421-1428 and 1430 at periodic or aperiodic intervals. Therefore, in this 
embodiment, I/O status information for the all of the interface modules 1420 is 
routed through the interface module 1429 and the interface modules 1420 
acquire I/O status information for non-local I/O devices 1440 and 1450 by way 
of the interface module 1429 rather than directly from the remaining interface 
modules 1420. 

[0202] From the foregoing description, a number of advantages 
of the preferred military vehicle control system are apparent, some of which 
have already been mentioned. First, the control system is constructed and 
arranged such that failure at a single location does not render the entire vehicle 
in operable. The control system has the ability to dynamically reconfigure itself 
in the event that one or more interface modules are lost. By avoiding the use of 
a central control unit that is fixed at one location, and using a moving central 
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control unit, there is no single point failure. If a master interface modules fails, 
another interface module will assume the position of the central control unit. 

[0203] Additionally, because the interface modules are 
interchangeable, if one interface module is damaged, it is possible to field 
service the control system by swapping interface modules, obtained either from 
within the vehicle itself or from another vehicle, even if the other vehicle is not 
the same variant type. This allows the effectiveness of the military vehicle to be 
maximized by allowing undamaged interface modules to be utilized in the most 
optimal manner. 

[02041 The use of the control system 1412 in connection with 
multipurpose modular vehicles is also advantageous. When the variant module is 
mounted to the chassis, all that is required is to connect power, ground and the 
communication network. Only one connector is required for all of the different 
types of variants. This avoids the need for a separate connector on the chassis 
for each different type of variant module, along with the additional unutilized 
hardware and wiring, as has conventionally been the approach utilized. 

[02051 Moreover, since every interface module has a copy of the 
application program, it is possible to test each interface module as an individual 
unit. The ability to do subassembly testing facilitates assembly of the vehicle 
because defective mechanisms can be replaced before the entire vehicle is 
assembled. 

[0206] Finally, the advantages regarding flexibility, robustness, 
ease of use, maintainability, and so on, that were discussed above in connection 
with firefighting vehicles also apply to military vehicles. For example, it is often 
desirable in military applications to provide vehicles with consoles for both a left- 
hand driver and a right-hand driver. This option can be implemented without 
complex wiring arrangements with the preferred control system, due to the 
distributed data collection and the intelligent processing of information from 
input devices. Likewise, features such as "smart start" (in which vehicle starting 
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is controlled automatically to reduce faulty starts due to operator error) can be 
inriplemented by the control system without any additional hardware, 

[0207] Many other changes and modifications may be made to 
the present invention without departing from the spirit thereof. The scope of 
these and other changes wijl become apparent from the appended claims. 
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